Affected: Homebrew: airshare
### Summary
A XSS vulnerability exists on index pages for static file handling.
### Details
When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
### Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable `show_index` if unable to upgrade.
-----
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Affected: PyPI: aiohttp
### Summary
A XSS vulnerability exists on index pages for static file handling.
### Details
When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
### Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable `show_index` if unable to upgrade.
-----
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
Affected: openEuler:20.03-LTS-SP4: python-aiohttp
Async http client/server framework (asyncio). Security Fix(es):
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.(CVE-2023-47627)
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to…
python310-aiohttp-3.9.5-2.1 on GA media
Affected: PyPI: aiohttp
### Summary
A XSS vulnerability exists on index pages for static file handling.
### Details
When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
### Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable `show_index` if unable to upgrade.
-----
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
pip: Mercurial configuration injectable in repo revision when installing via pip golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm python-cryptography: NULL-dereference when loading PKCS7 certificates pillow: Arbitrary Code Execution via the environment parameter python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() python-pydantic: regular expression denial of service via crafted email string sqlparse: parsing heavily nested list leads to denial of service psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override aiohttp: XSS on index pages for static file handling python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words() python-pillow: buffer overflow in _imagingcms.c follow-redirects: Possible credential leak aiohttp: DoS when trying to parse malformed POST requests python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django jinja2: accept…
Affected: Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.