botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2023-37276 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2023-37276 Source advisory: OSV:GHSA-45C4-8WX5-QW6W...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2023-37276 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2023-37276 Source advisory: OSV:GHSA-45C4-8WX5-QW6W...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2023-37276 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2023-37276 Source advisory: OSV:PYSEC-2023-120...

pyplanet (0.5.3) potentially affected by CVE-2023-37276 via aiohttp (2.3.3)

aiohttp PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyplanet 0.5.3 Source cves: CVE-2023-37276 Source advisory: OSV:GHSA-45C4-8WX5-QW6W...

muffin (>=0.7.1, <=0.8.6) potentially affected by CVE-2023-37276 via aiohttp (0.21.6)

aiohttp PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.7.1, =0.8.6 Source cves: CVE-2023-37276 Source advisory: OSV:PYSEC-2023-120...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2023-37276 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2023-37276 Source advisory: OSV:GHSA-45C4-8WX5-QW6W...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2023-37276 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2023-37276 Source advisory: OSV:GHSA-45C4-8WX5-QW6W...

CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

DEBIAN-CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

Design/Logic Flaw

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

UBUNTU-CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

CVE-2023-37276 aiohttp vulnerable to HTTP request smuggling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

0x20bf (0.0.1), 2keys (0.5.1) +1644 more potentially affected by CVE-2023-37276 via aiohttp (>=0.6.4, <=3.8.4)

aiohttp PYPI version =0.6.4, =0.0.1a0, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.3.3, =0.1.0, =0.5.6.dev0, =1.7.0, =1.9.0 - acmetk 0.0.2 and more Source cves: CVE-2023-37276 Source advisory: MEND:CVE-2023-37276...

CVE-2023-37276

CVE-2023-37276 affects aiohttp when used as an HTTP server (aiohttp.Application); vulnerable code is in the llhttp-based HTTP request parser bundled with aiohttp v3.8.4 and earlier. Exploitation can lead to HTTP request smuggling. The issue is addressed in aiohttp 3.8.5; upgrading is recommended....

CVE-2023-37276 aiohttp vulnerable to HTTP request smuggling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

CVE-2023-37276 aiohttp vulnerable to HTTP request smuggling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

PT-2023-4948 · Pypi +3 · Aiohttp +3

Name of the Vulnerable Software and Affected Versions: aiohttp versions 3.8.4 and earlier Description: The issue is related to the handling of HTTP requests in aiohttp, which can lead to HTTP request smuggling when a crafted HTTP request is sent. This affects users of aiohttp as an HTTP server, b...