PT-2023-7418

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling...

aiohttp environmental issue vulnerabilities

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. An environment issue vulnerability exists in aiohttp v3.8.4 and earlier versions that stems from easy HTTP request smuggling through the llhttp HTTP request parser...

CVE-2023-37276: Inconsistent Interpretation of HTTP Requests

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

SUSE CVE-2021-21330

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the...

MAL-2023-1576 Malicious code in aiohhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 11c5b5b7d743c8d72b3476ed08b8c2952de2c6b9b05a53072f0622aebf77fd33 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Ubuntu: Security Advisory (USN-5386-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

hugo-jupyter (>=0.2.1, <=0.3.0), modconf (>=0.4.0b7, <=0.4.0b9) +3 more potentially affected by CVE-2022-40897 via setuptools (36.2.0)

setuptools PYPI version 36.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - hugo-jupyter =0.2.1, =0.4.0b7, =0.5.0b10, =0.5.0b12 - ws-sheets-server 0.4.1b28 - ws-web-aiohttp 0.1.0b19 Source cves: CVE-2022-40897 Sourc...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2022-36359 +1 more via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2022-36359, CVE-2022-45442 Source...

GLSA-202208-19 : aiohttp: Open redirect vulnerability

The remote host is affected by the vulnerability described in GLSA-202208-19 aiohttp: Open redirect vulnerability - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link t...

aiohttp: Open redirect vulnerability

Background aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Description A bug in aiohttp.webmiddlewares.normalizepathmiddleware creates an open redirect vulnerability. Impact An attacker use this vulnerability to craft a link that, while appearing to be a link to an...

aiohttp-boilerplate (>=0.1.1, <=0.1.7), aioload (0.2.4) potentially affected by unknown CVE via pycares (3.0.0)

pycares PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pycares and may be impacted: - aiohttp-boilerplate =0.1.1, =0.1.7 - aioload 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-C58J-88F5-H53F...

aiohttp-rapid (0.0.0), headbot (0.1.0) +3 more potentially affected by unknown CVE via pycares (3.1.1)

pycares PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pycares and may be impacted: - aiohttp-rapid 0.0.0 - headbot 0.1.0 - monitapi =0.3.0, =1.0.0.dev0, =2.1.2.dev3, =2.1.6 Source cves: unknown CVE Source advisory:...

aiohttp-rapid (0.0.0), sap-computer-vision-package (>=1.0.12, <=1.1.7) potentially affected by CVE-2022-31116 via ujson (4.0.0)

ujson PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - aiohttp-rapid 0.0.0 - sap-computer-vision-package =1.0.12, =1.1.7 Source cves: CVE-2022-31116 Source advisory: OSV:GHSA-WPQR-JCPX-745R...

aio-binance-library (>=2.0.1, <=2.0.6), aiohttp-boilerplate (0.2.6) +31 more potentially affected by CVE-2022-31116 via ujson (>=5.0.0, <=5.3.0)

ujson PYPI version =5.0.0, =2.0.1, =1.0.0, =0.9.0, =0.2.0, =0.2.1 - django-tbot-messages 0.2.2 - dsframework 0.1.98 - emerquant-dev 0.0.9 - fb-sapp 0.5.3 - gs-dbs-client 0.2.5.post44 - irisrelay 1.2.9 and more Source cves: CVE-2022-31116 Source advisory: OSV:GHSA-WPQR-JCPX-745R...

aio-binance-library (>=2.0.1, <=2.0.6), aiohttp-boilerplate (0.2.6) +31 more potentially affected by CVE-2022-31116 via ujson (>=5.0.0, <=5.3.0)

ujson PYPI version =5.0.0, =2.0.1, =1.0.0, =0.9.0, =0.2.0, =0.2.1 - django-tbot-messages 0.2.2 - dsframework 0.1.98 - emerquant-dev 0.0.9 - fb-sapp 0.5.3 - gs-dbs-client 0.2.5.post44 - irisrelay 1.2.9 and more Source cves: CVE-2022-31116 Source advisory: GHSA-WPQR-JCPX-745R...

aio-tinder (>=0.1.1, <=0.1.8), aiobitcoin (>=0.5.2, <=0.75.14) +127 more potentially affected by CVE-2022-31117 via ujson (1.35.0)

ujson PYPI version 1.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - aio-tinder =0.1.1, =0.5.2, =0.1.0, =0.1.1, =0.1.3, =0.1.0, =0.1.0, =0.0.1a1, =2.0.3, =1.1.0rc6, =2.0.0, =1.0.1, =1.0.16.1 - ax 0.39.0 and more Source...

aiohttp-rapid (0.0.0), sap-computer-vision-package (>=1.0.12, <=1.1.7) potentially affected by CVE-2022-31117 via ujson (4.0.0)

ujson PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - aiohttp-rapid 0.0.0 - sap-computer-vision-package =1.0.12, =1.1.7 Source cves: CVE-2022-31117 Source advisory: OSV:GHSA-FM67-CV37-96FF...

CVE-2022-33124

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service DoS. NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the...

aiohttp Denial of Service Vulnerability (CNVD-2022-74097)

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. aiohttp version v3.8.1 has a denial of service vulnerability that stems from failure to properly handle incoming error messages, which could be exploited by an attacker to cause a denial of service of the...

Denial Of Service (DoS)

aiohttp is vulnerable to denial of service. An attacker can crash the application by providing invalid IPv6 URLs to the parsemessage function of httpparser.py...