# CVE-2014-7143: PYSEC-2019-212 - Python Twisted 14.0 trustRoot is not respected in HTTP client

Source: https://junglewise.ai/threats/cve-2014-7143-twisted-trustroot-not-respected-in-http-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-11-12. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2014-7143 · Severity: low · CVSS 3.1 · Published 2019-11-12

Python Twisted is a networking framework used to build internet applications and services. A flaw in version 14.0.0 causes the HTTP client to ignore the trustRoot certificate validation setting, potentially allowing an attacker to perform man-in-the-middle attacks by presenting an untrusted certificate that would normally be rejected. This could lead to interception and modification of sensitive data transmitted over HTTPS connections.

Technologies: [twisted (PyPI)](https://junglewise.ai/threats/technologies/pypi-twisted). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2014-7143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-7143 being exploited in the wild.

**How severe is CVE-2014-7143?** Low severity, with a CVSS score of 3.1, published 12 November 2019.

**Which products and versions are affected?** twisted (PyPI) ECOSYSTEM:introduced=0,fixed=14.0.1, ECOSYSTEM:introduced=14.0.0,fixed=14.0.1.

**Is there a fix for CVE-2014-7143?** Yes. twisted (PyPI): upgrade to 14.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2014-7143 attacked?** It is attacked over the network.

**Am I affected by CVE-2014-7143?** Check whether you run twisted (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- twisted (PyPI): upgrade to 14.0.1 or later

  ```sh
  pip install "twisted>=14.0.1"
  ```


## Technical details

The vulnerability is a certificate validation bypass (CWE-295) in Twisted 14.0.0's HTTP client implementation. The trustRoot parameter, which specifies the root certificate authorities to trust, is not properly enforced during SSL/TLS handshake validation. An attacker on the network can exploit this by presenting a forged certificate that would normally be rejected if trustRoot validation were properly implemented. The attack requires network proximity and no authentication or user interaction. The vulnerability was fixed in Twisted 14.0.1.

## Affected products

- Twisted Twisted 14.0.0

## Identifiers

- CVE-2014-7143
- GHSA-3c45-wgjp-7v9r
- PYSEC-2019-212

## Timeline

- 2014-09-22: disclosed
- 2019-12-17: advisory
- 2014: patched: Fixed in version 14.0.1

## References

- [https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33](https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33)

## Related threats

- [Twisted HTTP/2 server denial of service via rapid stream reset](https://junglewise.ai/threats/twisted-unauthenticated-remote-denial-of-service-in-the-twisted-http-2-0f2d7a0e)
- [Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation](https://junglewise.ai/threats/cve-2026-83813-twisted-is-an-event-based-framework-for-internet-applications)
- [Twisted HTTP request smuggling via bare CR or LF in header](https://junglewise.ai/threats/cve-2026-115877-twisted-http-request-smuggling-in-twisted-web-via-a-bare-cr-or)
- [Twisted conch telnet unbounded subnegotiation buffer denial of service](https://junglewise.ai/threats/cve-2026-115778-twisted-unauthenticated-remote-denial-of-service-in-the-twisted)
- [Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.](https://junglewise.ai/threats/cve-2026-115776-twisted-unauthenticated-remote-denial-of-service-in-the-twisted)