CVE-2024-23334 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2024-23334

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

0x20bf (0.0.1), 2keys (0.5.1) +2093 more potentially affected by CVE-2024-23334 via aiohttp (>=1.0.5, <=3.9.1)

aiohttp PYPI version =1.0.5, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23334 Source advisory: MEND:CVE-2024-23334...

CVE-2024-23334 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2024-23334

CVE-2024-23334 affects aiohttp when used as a web server with static routes and follow_symlinks=True, where reading a file isn’t validated against the static root. The vulnerability enables directory traversal to access arbitrary files; PoC and multiple advisories reference this behavior in versi...

CVE-2024-23334

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2024-23334

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

CVE-2024-23829

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

0x20bf (0.0.1), 2keys (0.5.1) +2105 more potentially affected by CVE-2024-23829 via aiohttp (>=0.6.4, <=3.9.1)

aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23829 Source advisory: MEND:CVE-2024-23829...

CVE-2024-23829

CVE-2024-23829 affects aiohttp (Python HTTP client/server). The issue stems from lenient HTTP parsing in security-sensitive parts of the parser, which could fail to robustly match frame boundaries and allow request smuggling, and may trigger unhandled exceptions leading to resource exhaustion. Co...

CVE-2024-23829

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

CVE-2024-23829

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

GHSA-5H86-8MV2-JQ9F vulnerabilities

Vulnerabilities for packages: checkov, py3-cassandra-medusa, py3-aiohttp...

GHSA-5H86-8MV2-JQ9F vulnerabilities

Vulnerabilities for packages: checkov, py3.13-scanner-test-libraries-aiohttp, py3-cassandra-medusa, py3-aiohttp...

GHSA-5H86-8MV2-JQ9F aiohttp is vulnerable to directory traversal

Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static...

0x20bf (0.0.1), 2keys (0.5.1) +2093 more potentially affected by CVE-2024-23334 via aiohttp (>=1.0.5, <=3.9.1)

aiohttp PYPI version =1.0.5, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23334 Source advisory: OSV:GHSA-5H86-8MV2-JQ9F...

0x20bf (0.0.1), 2keys (0.5.1) +2093 more potentially affected by CVE-2024-23334 via aiohttp (>=1.0.5, <=3.9.1)

aiohttp PYPI version =1.0.5, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.3.3, =0.1.0, =0.1.15 and more Source cves: CVE-2024-23334 Source advisory: GHSA-5H86-8MV2-JQ9F...