Critical TrustRoot Bypass in Twisted Package: CVE-2014-7143
Summary
CVE-2014-7143: Python Twisted 14.0 trustRoot is not respected in HTTP client. Affects twisted versions < 14.0.2-1. Fixed in 14.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-driven networking engine written in Python, widely used for building networked applications. It provides a robust framework for handling various protocols and asynchronous programming. However, Twisted versions prior to 14.0.2-1 are vulnerable to a security issue where the trustRoot parameter is not properly respected in the HTTP client, potentially allowing unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2014-7143 arises from the improper handling of the trustRoot parameter in Twisted's HTTP client. This flaw can be exploited by attackers to bypass security measures, leading to the exposure of sensitive information. The issue is rooted in the way Twisted validates SSL certificates, which could allow malicious entities to intercept or manipulate data during transmission. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
14.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade twistedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement additional validation checks in your application to ensure that only trusted certificates are accepted. This may involve modifying the SSL context used in your HTTP client to enforce stricter validation rules.
Conclusion
CVE-2014-7143 represents a significant security risk for applications using the Twisted package prior to version 14.0.2-1. Users should prioritize upgrading their installations to protect against potential data breaches and unauthorized access. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for twisted →
FAQ
CVE-2014-7143 is a vulnerability in the Twisted package that allows the HTTP client to bypass the trustRoot parameter, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive information, data interception, and potential manipulation of data during transmission.
Users are strongly advised to upgrade to Twisted version 14.0.2-1 or later to mitigate the risk associated with this vulnerability.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
