Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-py3-twisted | Aug 22, 2024 | Mar 3, 2022 | |
| Amazon_linux | — | amazon-linux-upgrade-python-twisted-conch | Jun 10, 2022 | Mar 3, 2022 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 3, 2022 | |
| Debian | debian-upgrade-twisted | Mar 10, 2022 | Mar 3, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-python-twisted | Jan 12, 2023 | Mar 3, 2022 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Mar 3, 2022 | |
| Suse | — | suse-upgrade-python-twistedsuse-upgrade-python-twisted-docsuse-upgrade-python2-twistedsuse-upgrade-python3-twisted | Oct 26, 2022 | Mar 3, 2022 |
| Ubuntu | ubuntu-pro-upgrade-python-twistedubuntu-pro-upgrade-python-twisted-binubuntu-pro-upgrade-python-twisted-webubuntu-pro-upgrade-python3-twistedubuntu-upgrade-python-twistedubuntu-upgrade-python-twisted-binubuntu-upgrade-python3-twistedubuntu-upgrade-python3-twisted-bin | Mar 31, 2022 | Mar 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub