thanks Github for unilaterally reclassifying the severity of this as "high" despite the fact that we went with "low" after much discussion <https://github.com/advisories/GHSA-3476-c5c2-fr73>
0 Boosts
0 Likes
@glyph this is gonna need a bit more context for me
@fluffy Twisted is an async or event-driven I/O framework, which includes various client and server protocols. If you use Twisted in a naive way, just spin up an event loop and put it on the network, then a client which sends it too much traffic can relatively easily knock it over. The whole point of event-driven I/O is that it multiplexes over a single core. It does not contain a multiprocess scheduler or a load balancer so you need to write that part yourself if you want a robust service.
twisted is deficient here in several ways, chief among them that we do not ship a supervisor process that makes it easy for you to manage resource usage in multiple processes, or our own hardened internal load balancer. but the idea that "remote network traffic can cause memory allocation" (even unbounded allocation!) is a "high" severity issue is, frankly, goofy
I am just absolutely fuming about this because in the words of one of our users, "the vulnerability scanners are panicking". there is a huge amount of incentive right now for projects to disclose everything and not request CVEs because the infosec industry is just a giant mass of metrics-driven reactive panic. PHP is out here with unauthenticated RCE and yet that is *1* CVSS point worse than "if you send a lot of traffic, your single-core server will eventually OOM"
I hate how much work it is to operate internet-facing services these days too but for fuck's sake people you need to learn what watchdogs, ulimits, and load balancers are _before_ you expose something publicly. if you want to help the open source community sign up to actually add features that add meaningful security, don't just pray and spray ReDoS from your LLM.
a bunch more of these are probably going to drop so I need to find ways to yell this from the rooftops more loudly:
if your system is architected such that your availability depends entirely upon a *single-threaded protocol parser* running on a single core remains unblocked regardless of what unauthenticated remote parties send to you, you are just fucked.