Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections.
Отчет
A low impact HTTP request smuggling flaw was found in the aiohttp Python library, which is shipped in a number of Red Hat offerings, including Red Hat Ansible Automation Platform, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI. The pure-Python HTTP parser in aiohttp does not parse trailer sections of an HTTP request. When a pure-Python installation of aiohttp is used, for example when the C extensions are not installed or the AIOHTTP_NO_EXTENSIONS environment variable is enabled, a remote attacker could send a specially crafted HTTP request to perform request smuggling and bypass certain firewall or proxy protections. Red Hat Product Security rates this flaw as low severity because exploitation requires the pure-Python parser configuration and the impact is limited to integrity; this differs from the NIST CVSS score of 7.5 (Important), which does not reflect those constraints. Many Red Hat products and components, such as Red Hat AI Inference Server and a number of Red Hat OpenShift AI components, are not affected because the shipped aiohttp builds include the C extensions and the vulnerable pure-Python parsing path is not present. For affected components, the impact is a potential bypass of firewall or proxy protections via request smuggling, and fixes are being pursued by the responsible product teams; in a small number of deferred cases the fix has been postponed in light of the low severity rating, leaving a residual risk of request smuggling where pure-Python aiohttp deployments sit behind firewall or proxy protections.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-cni-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-must-gather-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-pilot-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-rhel9-operator | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-sail-operator-bundle | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cuda-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-rocm-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...
EPSS
3.7 Low
CVSS3