-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| twisted | pip | < 16.3.1 | 16.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Twisted's CGI handler processes HTTP headers into environment variables. RFC 3875 section 4.1.18 requires headers to be prefixed with 'HTTP_', but 'Proxy' is a special case that conflicts with the HTTP_PROXY environment variable. The init method of CGIProcess in twcgi.py was responsible for populating the CGI environment without filtering the Proxy header, allowing untrusted client data to set HTTP_PROXY. The fix in 16.3.1 likely added filtering for this header, as seen in similar httpoxy patches across other frameworks.
Ongoing coverage of React2Shell