{"action":"Upgrade twisted to 19.2.1 or later.","affected":[{"fixed":"19.2.1","introduced":"0"}],"component":"twisted","cve_ids":["CVE-2019-12387"],"ecosystem":"PyPI","epss":0.02523,"exploited":false,"fixed_versions":["19.2.1"],"ghsa_id":"GHSA-6cc5-2vg4-cc7m","id":"tcs_01M5KG8FCDPRFYPN1ZYPJENYAX","modified_at":"2023-11-08T04:01:03.808700Z","published_at":"2019-06-10T12:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-128","https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html","https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html","https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/","https://usn.ubuntu.com/4308-1/","https://usn.ubuntu.com/4308-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://github.com/advisories/GHSA-6cc5-2vg4-cc7m"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-128","url":"https://osv.dev/vulnerability/PYSEC-2019-128"}],"summary":"In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF."}