python3-twisted: Twisted is an event-based framework for internet applications
CVE-2023-46137 is fixed in 4 products on 1 platform, first by python3-twisted 18.9.0-11ubuntu0.20.04.3, released October 25, 2023. It is not reported as exploited. Patch Radar priority: Routine.
Twisted is an event-based framework for internet applications. Prior toversion 23.10.0rc1, when sending multiple HTTP requests in one TCP packet,twisted.web will process the requests asynchronously without guaranteeingthe response order. If one of the endpoints is controlled by an attacker,the attacker can delay the response on purpose to manipulate the responseof the second request when a victim launched two requests using HTTPpipeline. Version 23.10.0rc1 contains a patch for this issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python3-twisted · Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.3 | python3-twisted 18.9.0-11ubuntu0.20.04.3 | Oct 25, 2023 |
| python3-twisted · Ubuntu 22.04.1 LTS (jammy) | 22.1.0-2ubuntu2.4 | python3-twisted 22.1.0-2ubuntu2.4 | Oct 25, 2023 |
| python3-twisted · Ubuntu 24.04.5 LTS (noble) | 22.4.0-4ubuntu1 | python3-twisted 22.4.0-4ubuntu1 | Oct 25, 2023 |
| python3-twisted · Ubuntu 24.10 (oracular) | 22.4.0-4ubuntu1 | python3-twisted 22.4.0-4ubuntu1 | Jan 16, 2026 |
| python3-twisted · Ubuntu 25.04 (plucky) | 22.4.0-4ubuntu1 | python3-twisted 22.4.0-4ubuntu1 | Jan 16, 2026 |
| python3-twisted · amzn 2023 | 22.4.0-126.amzn2023.0.3 | ALAS2023-2023-432 | Nov 9, 2023 |
| python3-twisted+tls · amzn 2023 | 22.4.0-126.amzn2023.0.3 | ALAS2023-2023-432 | Nov 9, 2023 |
| python3-twisted-bin · Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.3 | python3-twisted-bin 18.9.0-11ubuntu0.20.04.3 | Oct 25, 2023 |
| twisted · Debian 12.15 (bookworm) | 22.4.0-4+deb12u1 | DSA-5797-1 | Oct 25, 2024 |
| twisted · Debian 13.5 (trixie) | 23.10.0-1 | DEBIAN-CVE-2023-46137 | Oct 25, 2023 |
| twisted · Debian 14 | 23.10.0-1 | DEBIAN-CVE-2023-46137 | Oct 25, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.