homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2024-52304 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2024-52304 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2024-52304 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

interest (0.0.1) potentially affected by CVE-2024-52304 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2024-52304 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-52304 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

aiohttp allows request smuggling due to incorrect parsing of chunk extensions

Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker m...

GHSA-8495-4G3G-X7PR vulnerabilities

Vulnerabilities for packages: py3-aiohttp, airflow, kserve, checkov, py3-cassandra-medusa, dask-gateway...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2024-52304 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

duniterpy (0.40.8), jenkins-epo (>=1.159.0, <=1.160.0) potentially affected by CVE-2024-52304 via aiohttp (2.0.0rc1)

aiohttp PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - duniterpy 0.40.8 - jenkins-epo =1.159.0, =1.160.0 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2024-52304 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

0x20bf (0.0.1), 2keys (0.5.1) +2472 more potentially affected by CVE-2024-52304 via aiohttp (>=3.0.0b0, <=3.10.10)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2024-52304 Source advisory: GHSA-8495-4G3G-X7PR...

0x20bf (0.0.1), 2keys (0.5.1) +2472 more potentially affected by CVE-2024-52304 via aiohttp (>=3.0.0b0, <=3.10.10)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2024-52304 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2024-52304 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2024-52304 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2024-52304 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

muffin (0.7.0), solo (0.0.1) potentially affected by CVE-2024-52304 via aiohttp (0.21.5)

aiohttp PYPI version 0.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.7.0 - solo 0.0.1 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

muffin (0.5.1) potentially affected by CVE-2024-52304 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2024-52304 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...