PYSEC-2023-247

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

0x20bf (0.0.1), 2keys (0.5.1) +1727 more potentially affected by CVE-2023-47627 via aiohttp (>=0.6.4, <=3.8.5)

aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-47627 Source advisory: MEND:CVE-2023-47627...

CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627

aiohttp (Python asyncio HTTP client/server) contains a vulnerability in its HTTP parser that can lead to request smuggling when the parser is used (AIOHTTP_NO_EXTENSIONS). The issue is fixed in release 3.8.6; upgrade to 3.8.6 or later. The vulnerability is tied to header parsing and is addressed ...

CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47641 Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

CVE-2023-47641 Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

CVE-2023-47641 Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

0x20bf (0.0.1), 2keys (0.5.1) +1052 more potentially affected by CVE-2023-47641 via aiohttp (>=0.6.4, <=3.7.4.post0)

aiohttp PYPI version =0.6.4, =0.0.1a0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =0.1.6, =0.1.8 and more Source cves: CVE-2023-47641 Source advisory: MEND:CVE-2023-47641...

CVE-2023-47641

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

CVE-2023-47641

CVE-2023-47641 affects aiohttp (Python), where HTTP/1.1 handling can misinterpret requests when both Content-Length and Transfer-Encoding headers are present. The vendor describes a PoC using a reverse proxy that accepts both headers, with aiohttp backend treating chunked input as valid and Conte...

CVE-2023-47641

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

GHSA-XX9P-XXVH-7G8J Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-LengthCL and Transfer-EncodingTE it can lead to incorrect interpretation of two entities that parse the HTTP and we can poiso...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2023-47641 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2023-47641 Source advisory: OSV:GHSA-XX9P-XXVH-7G8J...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2023-47641 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2023-47641 Source advisory: OSV:GHSA-XX9P-XXVH-7G8J...

interest (0.0.1) potentially affected by CVE-2023-47641 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2023-47641 Source advisory: OSV:GHSA-XX9P-XXVH-7G8J...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2023-47641 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2023-47641 Source advisory: OSV:GHSA-XX9P-XXVH-7G8J...