Summary
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-23829)
Takeshi Kaneko discovered that AIOHTTP did not properly sanitize certain
inputs. A remote attacker could possibly use this issue to perform a
cross-site scripting (XSS) attack. (CVE-2024-27306)
It was discovered that AIOHTTP did not correctly handle certain POST
requests. A remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)
Jeppe Bonde Weikop discovered that AIOHTTP did not correctly handle
parsing newlines in certain inputs. A remote attacker could possibly use
this issue to perform request smuggling. (CVE-2024-52304)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-aiohttp | 3.6.2-1ubuntu1+esm4 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-aiohttp | 3.8.1-4ubuntu0.2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | python-aiohttp | 3.9.1-1ubuntu0.1+esm1 |
Vulnerabilities 7
-
High 7.5
Denial of service when trying to parse malformed POST requests in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and …
-
High 7.2
aiohttp's ClientSession is vulnerable to CRLF injection via version
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP versio…
-
Medium 6.5
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of p…
-
Medium 6.3
aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure…
-
Medium 6.1
aiohttp vulnerable to XSS on index pages for static file handling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for …
-
Medium 5.3
Request smuggling in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…
-
Medium 5.3
aiohttp's ClientSession is vulnerable to CRLF injection via method
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP met…
References
-
report
https://ubuntu.com/security/CVE-2023-47627
-
report
https://ubuntu.com/security/CVE-2023-49081
-
report
https://ubuntu.com/security/CVE-2023-49082
-
report
https://ubuntu.com/security/CVE-2024-23829
-
report
https://ubuntu.com/security/CVE-2024-27306
-
report
https://ubuntu.com/security/CVE-2024-30251
-
report
https://ubuntu.com/security/CVE-2024-52304