aiohttp Injection Vulnerability

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. An injection vulnerability exists in aiohttp versions prior to 3.9.0, which stems from incorrect validation that allows an attacker to modify an HTTP request e.g., by inserting a new header, or even create...

CVE-2023-49082: Improper Neutralization of CRLF Sequences

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request e.g. insert a new header or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if th...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2023-49081 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2023-49081 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2023-49081 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2023-49081 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2023-49081 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2023-49081 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

GHSA-Q3QX-C6G2-7PW2 aiohttp's ClientSession is vulnerable to CRLF injection via version

Summary Improper validation make it possible for an attacker to modify the HTTP request e.g. to insert a new header or even create a new HTTP request if the attacker controls the HTTP version. Details The vulnerability only occurs if the attacker can control the HTTP version of the request...

pushpull (0.0.2) potentially affected by CVE-2023-49081 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2023-49081 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

goblin (1.0.0b1) potentially affected by CVE-2023-49081 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

homeassistant (0.42.1) potentially affected by CVE-2023-49081 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

hassmart-homeassistant (0.60.0), homeassistant (>=0.60.0, <=0.60.1) +2 more potentially affected by CVE-2023-49081 via aiohttp (2.3.6)

aiohttp PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant 0.60.0 - homeassistant =0.60.0, =0.60.1 - pyplanet 0.5.4 - reliz 0.1.0.dev0 Source cves: CVE-2023-49081 Source advisory:...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2023-49081 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2023-49081 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2023-49081 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2023-49081 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

interest (0.0.1) potentially affected by CVE-2023-49081 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2023-49081 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2023-49081 Source advisory: OSV:GHSA-Q3QX-C6G2-7PW2...