A twisted security update has been released for Debian GNU/Linux 9 LTS to address an issue where SSH client and server implementations could accept an infinite amount of data for the peer's SSH version identifier.

DLA 2938-1: twisted security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2938-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Chris Lamb
March 08, 2022   https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : twisted
Version : 16.6.0-2+deb9u2
CVE ID : CVE-2022-21716

It was discovered that there was an issue in the Twisted Python
network framework where SSH client and server implementions could
accept an infinite amount of data for the peer's SSH version
identifier and that a buffer then uses all available memory.

For Debian 9 "Stretch", this problem has been fixed in version
16.6.0-2+deb9u2.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/twisted

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS