Описание
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
A flaw was found in Aiohttp. This issue may allow an attacker to send a crafted HTTP request to the server and smuggle arbitrary HTTP headers due to improper validation of HTTP requests during the processing of the HTTP request method. By exploiting this flaw, an attacker can manipulate HTTP requests and potentially poison the HTTP cache for phishing attacks.
Отчет
The vulnerability only occurs if the attacker can control the HTTP method (GET, POST etc.) of the request.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | aiohttp | Out of support scope | ||
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | python3x-aiohttp | Fixed | RHSA-2024:1057 | 29.02.2024 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | python-aiohttp | Fixed | RHSA-2024:1057 | 29.02.2024 |
| Red Hat Satellite 6.15 for RHEL 8 | python-aiohttp | Fixed | RHSA-2024:2010 | 23.04.2024 |
| Red Hat Satellite 6.15 for RHEL 8 | python-aiohttp | Fixed | RHSA-2024:2010 | 23.04.2024 |
| RHUI 4 for RHEL 8 | python-aiohttp | Fixed | RHSA-2024:1878 | 18.04.2024 |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
aiohttp is an asynchronous HTTP client/server framework for asyncio an ...
aiohttp's ClientSession is vulnerable to CRLF injection via method
5.3 Medium
CVSS3