https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:39:09 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-08455 bdu:2023-08455 https://cve.radiocsirt.org/vuln/bdu:2023-08455 https://cve.radiocsirt.org/vuln/brew-airshare-cve-2023-49081 <p><strong>Affected:</strong> Homebrew: airshare</p> <p>### Summary Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.</p> <p>### Details The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter. Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.</p> <p>At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.</p> <p>### PoC The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e</p> <p>### Impact CRLF injection leading to Request Smuggling.</p> <p>### Workaround If these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/7835/files</p> <p><strong>Affected:</strong> Homebrew: airshare</p> <p>### Summary Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.</p> <p>### Details The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter. Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.</p> <p>At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.</p> <p>### PoC The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e</p> <p>### Impact CRLF injection leading to Request Smuggling.</p> <p>### Workaround If these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/7835/files</p> https://cve.radiocsirt.org/vuln/brew-airshare-cve-2023-49081 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/euvd-2026-329613 EUVD-2026-329613 https://cve.radiocsirt.org/vuln/euvd-2026-329613 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49081 <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-49081 https://cve.radiocsirt.org/vuln/ghsa-q3qx-c6g2-7pw2 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.</p> <p>### Details The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter. Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.</p> <p>At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.</p> <p>### PoC The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e</p> <p>### Impact CRLF injection leading to Request Smuggling.</p> <p>### Workaround If these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/7835/files</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.</p> <p>### Details The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter. Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.</p> <p>At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.</p> <p>### PoC The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e</p> <p>### Impact CRLF injection leading to Request Smuggling.</p> <p>### Workaround If these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/7835/files</p> https://cve.radiocsirt.org/vuln/ghsa-q3qx-c6g2-7pw2 https://cve.radiocsirt.org/vuln/gsd-2023-49081 gsd-2023-49081 https://cve.radiocsirt.org/vuln/gsd-2023-49081 https://cve.radiocsirt.org/vuln/oesa-2023-1900 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-aiohttp, openEuler:20.03-LTS-SP3: python-aiohttp, openEuler:22.03-LTS: python-aiohttp, openEuler:22.03-LTS-SP1: python-aiohttp, openEuler:22.03-LTS-SP2: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.(CVE-2023-49081)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-aiohttp, openEuler:20.03-LTS-SP3: python-aiohttp, openEuler:22.03-LTS: python-aiohttp, openEuler:22.03-LTS-SP1: python-aiohttp, openEuler:22.03-LTS-SP2: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.(CVE-2023-49081)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1900 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13691-1 <p>python310-aiohttp-3.9.3-2.1 on GA media</p> <p>python310-aiohttp-3.9.3-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13691-1 https://cve.radiocsirt.org/vuln/pysec-2023-250 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> https://cve.radiocsirt.org/vuln/pysec-2023-250 https://cve.radiocsirt.org/vuln/rhsa-2024:1057 <p>pygments: ReDoS in pygments python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument python-aiohttp: numerous issues in HTTP parser with header parsing aiohttp: HTTP request modification aiohttp: CRLF injection if user controls the HTTP method using aiohttp client pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex platform: Insecure websocket used when interacting with EDA server jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Django: denial-of-service in ``intcomma`` template filter</p> <p>pygments: ReDoS in pygments python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument python-aiohttp: numerous issues in HTTP parser with header parsing aiohttp: HTTP request modification aiohttp: CRLF injection if user controls the HTTP method using aiohttp client pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex platform: Insecure websocket used when interacting with EDA server jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Django: denial-of-service in ``intcomma`` template filter</p> https://cve.radiocsirt.org/vuln/rhsa-2024:1057 https://cve.radiocsirt.org/vuln/suse-su-2024:0033-1 <p>Security update for python-aiohttp</p> <p>Security update for python-aiohttp</p> https://cve.radiocsirt.org/vuln/suse-su-2024:0033-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-49081 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-49081 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0522 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Phishing-Angriffe durchzuführen oder Cross-Site Scripting (XSS)-Angriffe auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Phishing-Angriffe durchzuführen oder Cross-Site Scripting (XSS)-Angriffe auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0522