Amazon Linux 2023 Security Advisory: ALAS-2024-746
Advisory Release Date: 2024-10-24 22:53 Pacific
Advisory Updated Date: 2024-10-31 16:00 Pacific
Severity:
Medium
Issue Overview:
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1. (CVE-2024-41810)
Affected Packages:
python-twisted
Issue Correction:
Run dnf update python-twisted --releasever 2023.6.20241028 to update your system.
New Packages:
noarch:
python3-twisted+tls-22.4.0-127.amzn2023.0.4.noarch
python3-twisted-22.4.0-127.amzn2023.0.4.noarch
src:
python-twisted-22.4.0-127.amzn2023.0.4.src