Lucene search

CVE-2024-23829

🗓️ 29 Jan 2024 23:08:15Reported by GitHub_MType

aiohttp async HTTP framework for Python, security vulnerabilities relating to HTTP parser, request smuggling issue, and incomplete fix

Reporter	Title	Published	Views	Family All 99
Cvelist	CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators	29 Jan 202422:41	–	cvelist
Cvelist	CVE-2023-47627 Request smuggling in aiohttp	14 Nov 202320:48	–	cvelist
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-23829	5 Mar 202500:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp, python-time-machine (SUSE-SU-2024:0577-1)	22 Feb 202400:00	–	nessus
Tenable Nessus	Fedora 38 : python-aiohttp (2024-0ddda4c691)	8 Feb 202400:00	–	nessus
Tenable Nessus	Fedora 41 : python-gcsfs (2024-9e55564ca7)	14 Nov 202400:00	–	nessus
Tenable Nessus	Fedora 39 : python-aiohttp (2024-f249b74f03)	5 Feb 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Satellite 6.14.3 Async Security Update (Moderate) (RHSA-2024:1536)	28 Apr 202400:00	–	nessus
Tenable Nessus	Fedora 38 : llhttp / python-aiohttp / uxplay (2023-bc1f081ca0)	6 Dec 202300:00	–	nessus
Tenable Nessus	Debian dla-4041 : python-aiohttp-doc - security update	3 Feb 202500:00	–	nessus

Nvd

Vulners

Node

aiohttp aiohttpRange<3.9.2

Node

fedoraproject fedoraMatch39

[
  {
    "vendor": "aio-libs",
    "product": "aiohttp",
    "versions": [
      {
        "version": "< 3.9.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/aio-libs/aiohttp/pull/8074
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2
github	www.github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

29 Jan 2024 23:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS36.5

EPSS0.00158

SSVC

CWE-444