PYSEC-2023-246

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

0x20bf (0.0.1), 2keys (0.5.1) +1618 more potentially affected by CVE-2023-47627 via aiohttp (>=3.0.0b0, <=3.8.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2023-47627 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2023-47627 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2023-47627 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2023-47627 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

muffin (0.5.1) potentially affected by CVE-2023-47627 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

muffin (0.5.0) potentially affected by CVE-2023-47627 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

hassmart-homeassistant (>=0.59.2, <=0.59.2.1), homeassistant (>=0.59.0, <=0.59.2) potentially affected by CVE-2023-47627 via aiohttp (2.3.5)

aiohttp PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant =0.59.2, =0.59.0, =0.59.2 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2023-47627 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2023-47627 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2023-47641 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

aiopixiv (1.0.5) potentially affected by CVE-2023-47627 via aiohttp (2.0.4)

aiohttp PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv 1.0.5 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2023-47627 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627

aiohttp (Python asyncio HTTP client/server) contains a vulnerability in its HTTP parser that can lead to request smuggling when the parser is used (AIOHTTP_NO_EXTENSIONS). The issue is fixed in release 3.8.6; upgrade to 3.8.6 or later. The vulnerability is tied to header parsing and is addressed ...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

0x20bf (0.0.1), 2keys (0.5.1) +1728 more potentially affected by CVE-2023-47627 via aiohttp (>=0.6.4, <=3.8.5)

aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-47627 Source advisory: MEND:CVE-2023-47627...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...