python-Twisted-doc-22.10.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12474 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python-Twisted-doc-22.10.0-1.1 on GA media These are all security issues fixed in the python-Twisted-doc-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12474 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:12474 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-39348/ SUSE CVE CVE-2022-39348 page openSUSE Tumbleweed python-Twisted-doc-22.10.0-1.1 python310-Twisted-22.10.0-1.1 python310-Twisted-all_non_platform-22.10.0-1.1 python310-Twisted-conch-22.10.0-1.1 python310-Twisted-conch_nacl-22.10.0-1.1 python310-Twisted-contextvars-22.10.0-1.1 python310-Twisted-http2-22.10.0-1.1 python310-Twisted-serial-22.10.0-1.1 python310-Twisted-tls-22.10.0-1.1 python38-Twisted-22.10.0-1.1 python38-Twisted-all_non_platform-22.10.0-1.1 python38-Twisted-conch-22.10.0-1.1 python38-Twisted-conch_nacl-22.10.0-1.1 python38-Twisted-contextvars-22.10.0-1.1 python38-Twisted-http2-22.10.0-1.1 python38-Twisted-serial-22.10.0-1.1 python38-Twisted-tls-22.10.0-1.1 python39-Twisted-22.10.0-1.1 python39-Twisted-all_non_platform-22.10.0-1.1 python39-Twisted-conch-22.10.0-1.1 python39-Twisted-conch_nacl-22.10.0-1.1 python39-Twisted-contextvars-22.10.0-1.1 python39-Twisted-http2-22.10.0-1.1 python39-Twisted-serial-22.10.0-1.1 python39-Twisted-tls-22.10.0-1.1 python-Twisted-doc-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-all_non_platform-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-conch-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-conch_nacl-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-contextvars-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-http2-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-serial-22.10.0-1.1 as a component of openSUSE Tumbleweed python310-Twisted-tls-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-all_non_platform-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-conch-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-conch_nacl-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-contextvars-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-http2-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-serial-22.10.0-1.1 as a component of openSUSE Tumbleweed python38-Twisted-tls-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-all_non_platform-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-conch-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-conch_nacl-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-contextvars-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-http2-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-serial-22.10.0-1.1 as a component of openSUSE Tumbleweed python39-Twisted-tls-22.10.0-1.1 as a component of openSUSE Tumbleweed Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds. CVE-2022-39348 openSUSE Tumbleweed:python-Twisted-doc-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-all_non_platform-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-conch-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-conch_nacl-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-contextvars-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-http2-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-serial-22.10.0-1.1 openSUSE Tumbleweed:python310-Twisted-tls-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-all_non_platform-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-conch-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-conch_nacl-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-contextvars-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-http2-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-serial-22.10.0-1.1 openSUSE Tumbleweed:python38-Twisted-tls-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-all_non_platform-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-conch-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-conch_nacl-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-contextvars-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-http2-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-serial-22.10.0-1.1 openSUSE Tumbleweed:python39-Twisted-tls-22.10.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-39348.html CVE-2022-39348 https://bugzilla.suse.com/1204781 SUSE Bug 1204781