Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:0034-1

Опубликовано: 05 янв. 2024
Источник: suse-cvrf

Описание

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2023-49081: fixed an HTTP header injection via a crafted version (bsc#1217684).

Список пакетов

Image SLES15-SP3-BYOS-Azure
python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-HPC-BYOS-Azure
python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-SAP-BYOS-Azure
python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-SAPCAL-Azure
python3-aiohttp-3.6.0-150100.3.15.1
SUSE Linux Enterprise Module for Public Cloud 15 SP1
python-aiohttp-doc-3.6.0-150100.3.15.1
python3-aiohttp-3.6.0-150100.3.15.1
SUSE Linux Enterprise Module for Public Cloud 15 SP2
python-aiohttp-doc-3.6.0-150100.3.15.1
python3-aiohttp-3.6.0-150100.3.15.1
SUSE Linux Enterprise Module for Public Cloud 15 SP3
python3-aiohttp-3.6.0-150100.3.15.1
SUSE Linux Enterprise Module for Public Cloud 15 SP4
python3-aiohttp-3.6.0-150100.3.15.1
SUSE Linux Enterprise Module for Public Cloud 15 SP5
python3-aiohttp-3.6.0-150100.3.15.1
openSUSE Leap 15.5
python-aiohttp-doc-3.6.0-150100.3.15.1
python3-aiohttp-3.6.0-150100.3.15.1

Ссылки

Описание

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Затронутые продукты
Image SLES15-SP3-BYOS-Azure:python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-HPC-BYOS-Azure:python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-SAP-BYOS-Azure:python3-aiohttp-3.6.0-150100.3.15.1
Image SLES15-SP3-SAPCAL-Azure:python3-aiohttp-3.6.0-150100.3.15.1
Ссылки