PT-2023-7245 · Aiohttp+5 · Aiohttp+5
Jnovikov
·
Publicado
2023-10-29
·
Atualizado
2025-11-04
·
CVE-2023-49082
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
aiohttp versions prior to 3.9.0
Description
The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can lead to HTTP request smuggling if the attacker can control the HTTP version of the request. The vulnerability occurs when an attacker can control the HTTP method of the request, such as GET or POST.
Recommendations
For versions prior to 3.9.0, update to version 3.9.0 to resolve the issue.
As a temporary workaround, consider performing manual validation of user-provided values for the request method, such as restricting it to known values like GET or POST.
Exploit
Correção
DoS
RCE
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Linuxmint
Red Os
Suse
Ubuntu
Aiohttp