PT-2023-4948 · Pypi+3 · Aiohttp+3

Sethmlarson · Publicado 2023-07-19 · Atualizado 2024-12-16 · CVE-2023-37276

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions aiohttp versions 3.8.4 and earlier

Description The issue is related to the handling of HTTP requests in aiohttp, which can lead to HTTP request smuggling when a crafted HTTP request is sent. This affects users of aiohttp as an HTTP server, but not those using it as an HTTP client library. The vulnerability is addressed in version 3.8.5.

Recommendations For aiohttp versions 3.8.4 and earlier, upgrade to version 3.8.5 to resolve the issue. As a temporary workaround for users unable to upgrade, reinstall aiohttp using AIOHTTP NO EXTENSIONS=1 as an environment variable to disable the llhttp HTTP request parser implementation.

Exploit

Correção

DoS

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

ALT-PU-2023-5594

ALT-PU-2024-16702

BDU:2023-05462

CVE-2023-37276

GHSA-45C4-8WX5-QW6W

PYSEC-2023-120

RHSA-2024:1878

RHSA-2024:2010

Produtos afetados

Alt Linux

Debian

Red Os

Aiohttp

Referências · 24

• 🔥 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37276.json · Exploit
• 🔥 https://hackerone.com/reports/2001873 · Exploit
• https://github.com/aio-libs/aiohttp · Nota
• https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40 · Correção
• https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules · Nota
• https://github.com/aio-libs/aiohttp/commit/9c13a52c21c23dfdb49ed89418d28a5b116d0681 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-120.yaml · Nota
• https://osv.dev/vulnerability/GHSA-45c4-8wx5-qw6w · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37276 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05462 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2023-37276 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37276 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-python3-aiohttp-cve-2023-49081-cve-2023-49082-cve-2023-47627-cve-2023-372 · Nota
• https://t.me/avleonovcom/1292 · Publicação no Telegram