All errata/sisyphus/ALT-PU-2024-6120-2
ALT-PU-2024-6120-2

Package update python3-module-aiohttp in branch sisyphus

Version3.9.1-alt1
Task#338371
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (10)

BDU:2023-08273
MEDIUM5.3

Уязвимость HTTP-клиента aiohttp, связанная с непринятием мер по нейтрализации последовательностей CRLF, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа HTTP Request Smuggling)

Published: 2023-12-01Modified: 2024-09-13
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
References
BDU:2023-08455
HIGH7.2

Уязвимость HTTP-клиента aiohttp, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю изменить HTTP-запрос или создать новый HTTP-запрос

Published: 2023-12-06Modified: 2024-03-20
CVSS 3.xHIGH 7.2
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2024-02173
HIGH7.5

Уязвимость HTTP-клиента aiohttp, связанная с недостатками обработки заголовков HTTP-запросов, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа HTTP Request Smuggling)

Published: 2024-03-20
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N
References
CVE-2023-47627
HIGH7.5

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

Published: 2023-11-14Modified: 2025-11-03
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2023-49081
MEDIUM5.3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Published: 2023-11-30Modified: 2025-11-04
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2023-49082
MEDIUM5.3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

Published: 2023-11-29Modified: 2025-11-04
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
GHSA-gfw2-4jvh-wgfg
MEDIUM6.9

AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Published: 2023-11-15Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
GHSA-q3qx-c6g2-7pw2
MEDIUM6.9

aiohttp's ClientSession is vulnerable to CRLF injection via version

Published: 2023-11-28Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
GHSA-qvrw-v9rv-5rjx
MEDIUM6.9

aiohttp's ClientSession is vulnerable to CRLF injection via method

Published: 2023-11-28Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References