Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:0168-1

Опубликовано: 19 янв. 2024
Источник: suse-cvrf

Описание

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

Updated to version 3.8.6:

  • CVE-2023-49082: Fixed an HTTP header injection via a crafted method (bsc#1217682).

Список пакетов

Image SLES15-SP4-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-HPC-BYOS
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-HPC-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP-Hardened
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP-Hardened-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAP-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAPCAL
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-SAPCAL-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-Azure-3P
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-Azure-Basic
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-Azure-Standard
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-HPC-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-HPC-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-SAP-Azure-3P
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-SAP-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-SAP-Hardened-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-SAP-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP5-SAPCAL-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-Azure-Basic
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-Azure-Standard
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-HPC
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-HPC-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-HPC-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAP-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAP-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAP-Hardened
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAP-Hardened-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAP-Hardened-BYOS-Azure
python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP6-SAPCAL-Azure
python311-aiohttp-3.8.6-150400.10.11.1
SUSE Linux Enterprise Module for Python 3 15 SP5
python311-aiohttp-3.8.6-150400.10.11.1
openSUSE Leap 15.5
python311-aiohttp-3.8.6-150400.10.11.1

Ссылки

Описание

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

Затронутые продукты
Image SLES15-SP4-BYOS-Azure:python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-HPC-BYOS-Azure:python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-HPC-BYOS:python311-aiohttp-3.8.6-150400.10.11.1
Image SLES15-SP4-Hardened-BYOS-Azure:python311-aiohttp-3.8.6-150400.10.11.1
Ссылки
Уязвимость SUSE-SU-2024:0168-1