Most recent entries from all

bdu:2024-02173

BREW-airshare-CVE-2023-47627 — AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Affected: Homebrew: airshare

# Summary The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel). # Details

## Bug 1: Bad parsing of `Content-Length` values

### Description RFC 9110 says this: > `Content-Length = 1*DIGIT`

AIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.

### Examples ``` GET / HTTP/1.1\r\n Content-Length: -0\r\n \r\n X ``` ``` GET / HTTP/1.1\r\n Content-Length: +0_1\r\n \r\n X ```

### Suggested action Verify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.

## Bug 2: Improper handling of NUL, CR, and LF in header values

### Description RFC 9110 says this: > Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.

AIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing the…

certfr-2024-avi-0145 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0145

EUVD-2026-258094

fkie_cve-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

GHSA-gfw2-4jvh-wgfg — AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Affected: PyPI: aiohttp

## Bug 1: Bad parsing of `Content-Length` values

### Description RFC 9110 says this: > `Content-Length = 1*DIGIT`

### Examples ``` GET / HTTP/1.1\r\n Content-Length: -0\r\n \r\n X ``` ``` GET / HTTP/1.1\r\n Content-Length: +0_1\r\n \r\n X ```

### Suggested action Verify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.

## Bug 2: Improper handling of NUL, CR, and LF in header values

AIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing the…

gsd-2023-47627

msrc_CVE-2023-47627 — Request smuggling in aiohttp

msrc_CVE-2023-47627

OESA-2025-1250 — python-aiohttp security update

Affected: openEuler:20.03-LTS-SP4: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to…

openSUSE-SU-2024:13465-1 — python310-aiohttp-3.9.0-1.1 on GA media

python310-aiohttp-3.9.0-1.1 on GA media

PYSEC-2023-246

Affected: PyPI: aiohttp

RHSA-2024:1057 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

pygments: ReDoS in pygments python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument python-aiohttp: numerous issues in HTTP parser with header parsing aiohttp: HTTP request modification aiohttp: CRLF injection if user controls the HTTP method using aiohttp client pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex platform: Insecure websocket used when interacting with EDA server jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Django: denial-of-service in ``intcomma`` template filter

UBUNTU-CVE-2023-47627

Affected: Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp

WID-SEC-W-2024-0522 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Phishing-Angriffe durchzuführen oder Cross-Site Scripting (XSS)-Angriffe auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.