homeassistant (0.42.1) potentially affected by CVE-2023-47627 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2023-47627 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2023-47627 Source advisory:...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2023-47627 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2023-47627 Source...

botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2023-47627 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2023-47627 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

homeassistant (>=0.38.0, <=0.38.4), okami (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2023-47627 via aiohttp (1.3.1)

aiohttp PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.38.0, =0.1.2, =0.1.3 - pyatv 0.1.4 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2023-47627 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2023-47627 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2023-47627 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2023-47627 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2023-47627 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

interest (0.0.1) potentially affected by CVE-2023-47627 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2023-47627 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

goblin (1.0.0b1) potentially affected by CVE-2023-47627 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-47627 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

GHSA-GFW2-4JVH-WGFG AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Summary The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. Details Bug 1: Bad parsing of Content-Length values Description RFC 9110 says this:...

0x20bf (0.0.1), 2keys (0.5.1) +1618 more potentially affected by CVE-2023-47627 via aiohttp (>=3.0.0b0, <=3.8.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

0x20bf (0.0.1), 2keys (0.5.1) +1618 more potentially affected by CVE-2023-47627 via aiohttp (>=3.0.0b0, <=3.8.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-47627 Source advisory: GHSA-GFW2-4JVH-WGFG...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2023-47627 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2023-47627 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2023-47627 Source advisory: OSV:GHSA-GFW2-4JVH-WGFG...