[ Reason ]
Catching up on outstanding security issues.
Security team deemed them no-dsa.
[ Impact ]
Outstanding security issues remain unresolved.
[ Tests ]
Twisted has a comprehensive test-suite, the relevant updates come with
tests, and no regressions were noticed.
[ Risks ]
The same patches are carried in Ubuntu, and in Debian LTS * ELTS.
They did need some backporting to older releases, but nothing too risky.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* CVE-2022-21712: Information disclosure results in leaking of HTTP cookie
and authorization headers when following cross origin redirects
- debian/patches/CVE-2022-21712-*.patch: Ensure sensitive HTTP headers are
removed when forming requests, in src/twisted/web/client.py,
src/twisted/web/test/test_agent.py and src/twisted/web/iweb.py.
- Thanks Canonical for backporting the patches.
* CVE-2022-21716: Parsing of SSH version identifier field during an SSH
handshake can result in a denial of service when excessively large packets
are received
- debian/patches/CVE-2022-21716-*.patch: Ensure that length of received
handshake buffer is checked, prior to processing version string in
src/twisted/conch/ssh/transport.py and
src/twisted/conch/test/test_transport.py
- Thanks Canonical for backporting the patches.
* CVE-2022-24801: Correct several defects in HTTP request parsing that could
permit HTTP request smuggling: disallow signed Content-Length headers,
forbid illegal characters in chunked extensions, forbid 0x prefix to chunk
lengths, and only strip space and horizontal tab from header values.
- debian/patches/CVE-2022-24801-*.patch
* Patch: remove spurious test for illegal whitespace in xmlns, to allow
tests to pass, again.
This was a regression introduced by the patch to expat for CVE-2022-25236.
The resolution upstream was to just delete the test.
[ Other info ]
(Anything else the release team should know.)