PT-2023-4948 · Pypi+3 · Aiohttp+3

Sethmlarson · Published 2023-07-19 · Updated 2024-12-16 · CVE-2023-37276

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions aiohttp versions 3.8.4 and earlier

Description The issue is related to the handling of HTTP requests in aiohttp, which can lead to HTTP request smuggling when a crafted HTTP request is sent. This affects users of aiohttp as an HTTP server, but not those using it as an HTTP client library. The vulnerability is addressed in version 3.8.5.

Recommendations For aiohttp versions 3.8.4 and earlier, upgrade to version 3.8.5 to resolve the issue. As a temporary workaround for users unable to upgrade, reinstall aiohttp using AIOHTTP NO EXTENSIONS=1 as an environment variable to disable the llhttp HTTP request parser implementation.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2023-5594

ALT-PU-2024-16702

BDU:2023-05462

CVE-2023-37276

GHSA-45C4-8WX5-QW6W

PYSEC-2023-120

RHSA-2024:1878

RHSA-2024:2010

Affected Products

Alt Linux

Debian

Red Os

Aiohttp

References · 24

• 🔥 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37276.json · Exploit
• 🔥 https://hackerone.com/reports/2001873 · Exploit
• https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37276 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37276 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-37276 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-120 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-37276 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37276 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45c4-8wx5-qw6w · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37276 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37276 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05462 · Security Note
• https://github.com/aio-libs/aiohttp · Note