Python Library aiohttp < 3.14.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324958);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/06");

  script_cve_id(
    "CVE-2026-54273",
    "CVE-2026-54275",
    "CVE-2026-54277",
    "CVE-2026-54279"
  );
  script_xref(name:"IAVA", value:"2026-A-0636");

  script_name(english:"Python Library aiohttp < 3.14.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the aiohttp Python library installed on the remote host is prior to 3.14.1. It is,
therefore, affected by multiple vulnerabilities:

  - Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An
    attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to
    DoS. (CVE-2026-54273)

  - Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused.
    If an application makes multiple requests to the same domain, but with different per-request
    server_hostname parameters, then the later calls may succeed by reusing the existing connection when they
    should have been rejected due to the TLS SNI check. (CVE-2026-54275)

  - Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C
    parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to
    send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to
    DoS. (CVE-2026-54277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?636e7866");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4b4a434");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2635dbf0");
  # https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b75bceb4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to aiohttp version 3.14.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-54279");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-54277");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:aiohttp:aiohttp");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'aiohttp';

var libs = python::get_package_info(pkg_name:pkg, cpe:"cpe:/a:aiohttp:aiohttp");

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'max_version' : '3.14.0', 'fixed_version' : '3.14.1' }
];

vcf::check_version_and_report(
  app_info:libs,
  constraints:constraints,
  severity:SECURITY_HOLE
);