In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10108
Reference (s):
- FEDORA:FEDORA-2020-16dc0da400
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/
- FEDORA:FEDORA-2020-2136b020f2
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/
- GENTOO:GLSA-202007-24