Skip to content
OpenAdvisories
Medium USN-6991-1 1 CVE

python-aiohttp vulnerability

Published Sep 5, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that AIOHTTP did not properly restrict file access when
the 'follow_symlinks' option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-aiohttp 3.8.1-4ubuntu0.2
Ubuntu · 24.04 LTS 24.04:LTS python-aiohttp 3.9.1-1ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-aiohttp 3.0.1-1ubuntu0.1~esm4
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-aiohttp 3.6.2-1ubuntu1+esm3

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-23334 Public exploit Scanner template EPSS 77%

    aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used…

    aio-libs aiohttp py3-cassandra-medusa checkov Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-23334