CVE catalog

CVE-2022-39348

twisted: CVE-2022-39348

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.59% · Oct 25, 2026

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantwistedsid26.4.0-6fixed
Debiantwistedforky26.4.0-6fixed
Debiantwistedtrixie24.11.0-1fixed
Debiantwistedbookworm22.4.0-4+deb12u1fixed
Debiantwistedbookworm-security22.4.0-4+deb12u1fixed
Ubuntutwisted20.0418.9.0-3ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-5vulnerable
Ubuntutwisted20.0418.9.0-6vulnerable
Ubuntutwisted20.0418.9.0-6build1vulnerable
Ubuntutwisted20.0418.9.0-6ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-8vulnerable
Ubuntutwisted20.0418.9.0-11vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.1vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.2vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.3fixed
Ubuntutwisted22.0420.3.0-7ubuntu1vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.1vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.4fixed
Ubuntutwistedpro16.6.0-2ubuntu3vulnerable
Ubuntutwistedpro17.9.0-1vulnerable
Ubuntutwistedpro17.9.0-2vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm2vulnerable
Ubuntutwisted20.0418.9.0-3ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-5vulnerable
Ubuntutwisted20.0418.9.0-6vulnerable
Ubuntutwisted20.0418.9.0-6build1vulnerable
Ubuntutwisted20.0418.9.0-6ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-8vulnerable
Ubuntutwisted20.0418.9.0-11vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.1vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.2vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.3fixed
Ubuntutwisted22.0420.3.0-7ubuntu1vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.1vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.4fixed
Susepython-Twistedlinux enterprise module for server applications 15 sp422.2.0-150400.5.7.1fixed
Opensusepython-Twistedleap 15.422.2.0-150400.5.7.1fixed
Opensusepython-Twistedtumbleweed22.10.0-1.1fixed
Susepython-Twistedlinux enterprise module for package hub 15 sp319.10.0-150200.3.18.1fixed
Susepython-Twistedlinux enterprise module for server applications 15 sp319.10.0-150200.3.18.1fixed
Opensusepython-Twistedleap 15.319.10.0-150200.3.18.1fixed
Opensusepython-Twistedleap 15.419.10.0-150200.3.18.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantwistedsourcesid22.4.0-4not yet assignedNot reported[1023359]
Debiantwistedsourceforky22.4.0-4not yet assignedNot reported[1023359]
Debiantwistedsourcetrixie22.4.0-4not yet assignedNot reported[1023359]
Debiantwistedsourcebookworm22.4.0-4not yet assignedNot reported[1023359]
Ubuntutwisteddeb20.0418.9.0-11ubuntu0.20.04.3Not reportedUSN-6575-1Not reported
Ubuntutwisteddeb22.0422.1.0-2ubuntu2.4Not reportedUSN-6575-1Not reported
Ubuntutwisteddeb20.0418.9.0-11ubuntu0.20.04.3Not reportedUBUNTU-CVE-2022-39348Not reported
Ubuntutwisteddeb22.0422.1.0-2ubuntu2.4Not reportedUBUNTU-CVE-2022-39348Not reported
Susepython-Twistedrpmlinux enterprise module for server applications 15 sp422.2.0-150400.5.7.1Not reportedSUSE-SU-2022:4000-1Not reported
Opensusepython-Twistedrpmleap 15.422.2.0-150400.5.7.1Not reportedSUSE-SU-2022:4000-1Not reported
Opensusepython-Twistedrpmtumbleweed22.10.0-1.1Not reportedOPENSUSE-SU-2024:12474-1Not reported
Susepython-Twistedrpmlinux enterprise module for package hub 15 sp319.10.0-150200.3.18.1Not reportedSUSE-SU-2022:4057-1Not reported
Susepython-Twistedrpmlinux enterprise module for server applications 15 sp319.10.0-150200.3.18.1Not reportedSUSE-SU-2022:4057-1Not reported
Opensusepython-Twistedrpmleap 15.319.10.0-150200.3.18.1Not reportedSUSE-SU-2022:4057-1Not reported
Opensusepython-Twistedrpmleap 15.419.10.0-150200.3.18.1Not reportedSUSE-SU-2022:4057-1Not reported

[Debian bug #1023359]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-Twisted]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-all_non_platform]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-conch]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-conch_nacl]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-contextvars]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-http2]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-serial]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python313-Twisted-tls]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-all_non_platform]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-conch]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-conch_nacl]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-contextvars]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-http2]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-serial]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python314-Twisted-tls]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

  • [python-Twisted-doc]Unknown

    Source package: [python-Twisted]

    Details (1)

    • 26.4.0-3.3 · noarch · tumbleweed

      Unknown · Fixed: 22.10.0-1.1

      Version impact unknown

      dsa · python-Twisted · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [python3-twisted]Fixed

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

  • [twisted-doc]Fixed

    Source package: [twisted]

    Details (4)

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

    • 22.4.0-4+deb12u1 · all · bookworm-security

      Fixed · Fixed: 22.4.0-4

      dsa · twisted · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]