Executive brief
Python Twisted is a networking framework used to build internet applications and services. A flaw in version 14.0.0 causes the HTTP client to ignore the trustRoot certificate validation setting, potentially allowing an attacker to perform man-in-the-middle attacks by presenting an untrusted certificate that would normally be rejected. This could lead to interception and modification of sensitive data transmitted over HTTPS connections.
Technical details
The vulnerability is a certificate validation bypass (CWE-295) in Twisted 14.0.0's HTTP client implementation. The trustRoot parameter, which specifies the root certificate authorities to trust, is not properly enforced during SSL/TLS handshake validation. An attacker on the network can exploit this by presenting a forged certificate that would normally be rejected if trustRoot validation were properly implemented. The attack requires network proximity and no authentication or user interaction. The vulnerability was fixed in Twisted 14.0.1.
Affected products
- Twisted Twisted 14.0.0
Timeline
- 2014-09-22: disclosed
- 2019-12-17: advisory
- 2014: patched: Fixed in version 14.0.1