aioHTTP < 3.14.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320552);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id("CVE-2026-34993", "CVE-2026-47265");
  script_xref(name:"IAVB", value:"2026-B-0148");

  script_name(english:"aioHTTP < 3.14.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of aioHTTP installed on the remote host is prior to 3.14.0. It is, therefore,
affected by multiple vulnerabilities:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0,
    using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using
    this function will be doing so with the user's own data, so this is unlikely to affect many applications.
    Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a
    workaround on older releases would be to sanitize the files before loading. (CVE-2026-34993)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0,
    cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a
    developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an
    attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade,
    using a Cookie header in the headers parameter is not vulnerable. (CVE-2026-47265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b1baccce");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43d4a02d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to aioHTTP version 3.14.0 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-47265");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:python:aioHTTP");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin");
  script_require_keys("Host/nix/packages", "Host/nix/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'aiohttp';
var cpe = 'cpe:/a:python:aioHTTP';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'fixed_version' : '3.14.0' }
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_HOLE);