Most recent entries from all

bdu:2024-00995

BREW-airshare-CVE-2024-23334 — aiohttp is vulnerable to directory traversal

Affected: Homebrew: airshare

### Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.

### Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.

i.e. An application is only vulnerable with setup code like: ``` app.router.add_routes([ web.static("/static", "static/", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability ]) ```

### Impact This is a directory traversal vulnerability with CWE ID 22. When using aiohttp as a web server and enabling static resource resolution with `follow_symlinks` set to True, it can lead to this vulnerability. This vulnerability has been present since the introduction of the `follow_symlinks` parameter.

### Workaround Even if upgrading to a patched version of aiohttp, we recommend following these steps regardless.

If using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT…

certfr-2024-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0199

EUVD-2026-267353

fkie_cve-2024-23334

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

GHSA-5h86-8mv2-jq9f — aiohttp is vulnerable to directory traversal

Affected: PyPI: aiohttp

### Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.

### Workaround Even if upgrading to a patched version of aiohttp, we recommend following these steps regardless.

If using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT…

gsd-2024-23334

msrc_CVE-2024-23334 — aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

msrc_CVE-2024-23334

OESA-2025-1250 — python-aiohttp security update

Affected: openEuler:20.03-LTS-SP4: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.(CVE-2023-47627)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)

openSUSE-SU-2024:13642-1 — python310-aiohttp-3.9.3-1.1 on GA media

python310-aiohttp-3.9.3-1.1 on GA media

PYSEC-2024-24

Affected: PyPI: aiohttp

RHSA-2024:1536 — Red Hat Security Advisory: Satellite 6.14.3 Async Security Update

Hub: insecure galaxy-importer tarfile extraction python-django: Denial-of-service possibility in django.utils.text.Truncator python-aiohttp: numerous issues in HTTP parser with header parsing aiohttp: HTTP request modification jinja2: HTML attribute injection when passing user input as keys to xmlattr filter aiohttp: follow_symlinks directory traversal vulnerability python-aiohttp: http request smuggling

UBUNTU-CVE-2024-23334

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:22.04:LTS: python-aiohttp, Ubuntu:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp

WID-SEC-W-2024-0949 — Red Hat Satellite: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, HTTP-Request-Smuggling-Angriffe durchzuführen oder Phishing- und Cross-Site-Scripting (XSS)-Angriffe auszuführen.