Security Bulletin: IBM Storage Fusion HCI is vulnerable to HTTP request smuggling, denial of server due to aiohttp, cryptography.

Summary aiohttp, cryptography and Gunicorn are used by IBM Storage Fusion HCI as part of the Backup and Restore service and may be vulnerable to the CVEs listed below. CVE-2024-23829, CVE-2024-23334, CVE-2024-1135, CVE-2024-26130. Vulnerability Details CVEID:CVE-2024-23829 DESCRIPTION: aio-libs...

aiohttp < 3.8.6 HTTP Request Smuggling Vulnerability - Linux

aiohttp is prone to a HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

aiohttp < 3.7.4 Open Redirect Vulnerability - Linux

aiohttp is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

aiohttp < 3.8.0 Security Vulnerability - Linux

aiohttp is prone to a security vulnerability regarding the inconsistent interpretation of the http protocol. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

aiohttp < 3.8.0 Security Vulnerability - Windows

aiohttp is prone to a security vulnerability regarding the inconsistent interpretation of the http protocol. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

aiohttp < 3.8.6 HTTP Request Smuggling Vulnerability - Windows

aiohttp is prone to a HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

aiohttp < 3.8.5 HTTP Request Smuggling Vulnerability - Windows

aiohttp is prone to a HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

aiohttp < 3.8.5 HTTP Request Smuggling Vulnerability - Linux

aiohttp is prone to a HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

aiohttp < 3.7.4 Open Redirect Vulnerability - Windows

aiohttp is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

aiohttp < 3.9.0 Multiple Vulnerabilities - Linux

aiohttp is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

GHSA-5M98-QGG9-WH84 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-30251 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-30251 Source...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2024-30251 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

aiopogo (>=2.0.1, <=2.1.0b0), aiosparql (>=0.0.0, <=0.10.0a3) +6 more potentially affected by CVE-2024-30251 via aiohttp (2.1.0)

aiohttp PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopogo =2.0.1, =0.0.0, =0.46.0, =0.4.0, =0.0.2, =0.4.4 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2024-30251 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2024-30251 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2024-30251 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

botstory (0.0.63) potentially affected by CVE-2024-30251 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2024-30251 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2024-30251 Source advisory: OSV:GHSA-5M98-QGG9-WH84...

0x20bf (0.0.1), 2keys (0.5.1) +2090 more potentially affected by CVE-2024-30251 via aiohttp (>=3.0.0b0, <=3.9.4rc0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-30251 Source advisory: GHSA-5M98-QGG9-WH84...