PT-2021-2299 · Pypi+4 · Aiohttp+4

G147 + 1 · Published 2021-02-25 · Updated 2024-06-15 · CVE-2021-21330

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.7.4

Description The issue is related to an open redirect vulnerability in the aiohttp library, which can allow a remote attacker to conduct phishing attacks using a specially crafted link. This vulnerability is caused by a bug in the aiohttp.web middlewares.normalize path middleware middleware.

Recommendations For versions prior to 3.7.4, upgrade your dependency using pip as follows: "pip install aiohttp >= 3.7.4". If upgrading is not an option, a workaround can be to avoid using aiohttp.web middlewares.normalize path middleware in your applications.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-1490

AZL-44805

BDU:2021-01528

CVE-2021-21330

DSA-4864-1

GHSA-V6WP-4M6F-GCJG

MGASA-2021-0161

OPENSUSE-SU-2024:13209-1

PYSEC-2021-76

RHSA-2021:4702

SUSE-RU-2022:3275-1

SUSE-SU-2021:1313-1

SUSE-SU-2021_1313-1

USN-5386-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Aiohttp

References · 47

• https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21330 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21330 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-76 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5 · Vendor Advisory
• https://debian.org/security/2021/dsa-4864 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13209-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21330 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21330 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2022:3275-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21330 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5 · Vendor Advisory