7770 matches found
CVE-2024-23829
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...
CVE-2024-23829
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...
CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...
0x20bf (0.0.1), 2keys (0.5.1) +2107 more potentially affected by CVE-2024-23829 via aiohttp (>=0.6.4, <=3.9.1)
aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23829 Source advisory: MEND:CVE-2024-23829...
CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...
CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...
GHSA-5H86-8MV2-JQ9F vulnerabilities
Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, py3-cassandra-medusa, checkov, py3-aiohttp...
GHSA-5H86-8MV2-JQ9F vulnerabilities
Vulnerabilities for packages: py3-cassandra-medusa, py3-aiohttp, checkov...
0x20bf (0.0.1), 2keys (0.5.1) +2095 more potentially affected by CVE-2024-23334 via aiohttp (>=1.0.5, <=3.9.1)
aiohttp PYPI version =1.0.5, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23334 Source advisory: OSV:GHSA-5H86-8MV2-JQ9F...
aiohttp is vulnerable to directory traversal
Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static...
GHSA-5H86-8MV2-JQ9F aiohttp is vulnerable to directory traversal
Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static...
0x20bf (0.0.1), 2keys (0.5.1) +2095 more potentially affected by CVE-2024-23334 via aiohttp (>=1.0.5, <=3.9.1)
aiohttp PYPI version =1.0.5, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23334 Source advisory: GHSA-5H86-8MV2-JQ9F...
muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2024-23829 via aiohttp (0.14.1)
aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2024-23829 Source advisory: OSV:GHSA-8QPW-XQXJ-H4R2...
aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2024-23829 via aiohttp (0.22.5)
aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2024-23829 Source advisory: OSV:GHSA-8QPW-XQXJ-H4R2...
botstory (0.0.63) potentially affected by CVE-2024-23829 via aiohttp (2.0.1)
aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2024-23829 Source advisory: OSV:GHSA-8QPW-XQXJ-H4R2...
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Summary Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger...
aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2024-23829 via aiohttp (2.0.7)
aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2024-23829 Source advisory:...
hassmart-homeassistant (>=0.59.2, <=0.59.2.1), homeassistant (>=0.59.0, <=0.59.2) potentially affected by CVE-2024-23829 via aiohttp (2.3.5)
aiohttp PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant =0.59.2, =0.59.0, =0.59.2 Source cves: CVE-2024-23829 Source advisory: OSV:GHSA-8QPW-XQXJ-H4R2...