Twisted SSH client and server deny of service during SSH handshake.
Impact
The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.
A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as nc -rv localhost 22 < /dev/zero.
Patches
The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
A fix is available in Twisted 22.2.0.
Workarounds
- Limit access to the SSH server only to trusted source IP addresses.
- Connect over SSH only to trusted destination IP addresses.
References
Reported at https://twistedmatrix.com/trac/ticket/10284 Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
For more information
Found by vin01
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | twisted | >= 21.7.0, < 22.2.0 | 22.2.0 |
Referencias
- https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9
- https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
- https://twistedmatrix.com/trac/ticket/10284
- https://github.com/twisted/twisted/releases/tag/twisted-22.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2022-21716
- https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
- https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-160.yaml
- https://github.com/twisted/twisted
- https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- https://security.gentoo.org/glsa/202301-02
- https://www.oracle.com/security-alerts/cpuapr2022.html
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-120, CWE-770- Plataforma
- Python (PyPI)
- Paquete
twisted- Publicada
- 03.03.2022
- Actualizado
- 11.10.2026 11:20
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2022-160 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-rv6r-3f5q-9rgx - CC BY 4.0
Historial de vulnerabilidades: twisted
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 17
- Primera → última
- 06.2019 10.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 5
- Alta 4
- Media 8
Divulgaciones por año
- 2019: 3
- 2020: 3
- 2021: 0
- 2022: 6
- 2023: 1
- 2024: 2
- 2025: 0
- 2026: 2
-
Twisted SSH client and server deny of service during SSH handshake. esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.