botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2023-47641 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2023-47641 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2023-47627 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

hassmart-homeassistant (0.60.0), homeassistant (>=0.60.0, <=0.60.1) +2 more potentially affected by CVE-2023-47641 via aiohttp (2.3.6)

aiohttp PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant 0.60.0 - homeassistant =0.60.0, =0.60.1 - pyplanet 0.5.4 - reliz 0.1.0.dev0 Source cves: CVE-2023-47641 Source advisory:...

homeassistant (0.42.1) potentially affected by CVE-2023-47641 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2023-47627 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

PYSEC-2023-246

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

muffin (0.5.1) potentially affected by CVE-2023-47641 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2023-47627 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2023-47641 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

scriptworker (0.2.1) potentially affected by CVE-2023-47641 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2023-47641 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2023-47641 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

aiobotocore (>=0.4.0, <=0.4.1), async-patterns (0.2.0) +7 more potentially affected by CVE-2023-47627 via aiohttp (2.2.0)

aiohttp PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore =0.4.0, =0.1.1, =0.2.2, =0.48.0, =0.4.1b2, =0.5.2b0, =0.1.0a88, =0.1.0b10 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2023-47641 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2023-47641 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2023-47627 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2023-47627 Source advisory: OSV:PYSEC-2023-246...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2023-47641 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

CVE-2023-47627 Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...

CVE-2023-47627

aiohttp (Python asyncio HTTP client/server) contains a vulnerability in its HTTP parser that can lead to request smuggling when the parser is used (AIOHTTP_NO_EXTENSIONS). The issue is fixed in release 3.8.6; upgrade to 3.8.6 or later. The vulnerability is tied to header parsing and is addressed ...