PT-2023-7418 · Aiohttp+5 · Aiohttp+5
Jnovikov
·
Publicado
2023-07-19
·
Atualizado
2025-11-04
·
CVE-2023-49081
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
aiohttp versions prior to 3.9.0
Description
The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling. The vulnerability is exploitable when the attacker can control the HTTP version of the request, including its type, and when the
Connection header is passed to the headers parameter. For example, if an unvalidated JSON value is used as a version and the attacker passes an array as the version parameter, it can bypass validation.Recommendations
For versions prior to 3.9.0, update to version 3.9.0 to resolve the issue.
As a temporary workaround, validate the user input to the
version parameter to ensure it is a str.Exploit
Correção
DoS
RCE
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Linuxmint
Red Os
Suse
Ubuntu
Aiohttp