USN-7642-1

Dashboard / Vulnerabilities / USN-7642-1

USN-7642-1

Summary: python-aiohttp vulnerabilities

Details: Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627) Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082) Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23829) Takeshi Kaneko discovered that AIOHTTP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. (CVE-2024-27306) It was discovered that AIOHTTP did not correctly handle certain POST requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251) Jeppe Bonde Weikop discovered that AIOHTTP did not correctly handle parsing newlines in certain inputs. A remote attacker could possibly use this issue to perform request smuggling. (CVE-2024-52304)

References: https://ubuntu.com/security/notices/USN-7642-1, https://ubuntu.com/security/CVE-2023-47627, https://ubuntu.com/security/CVE-2023-49081, https://ubuntu.com/security/CVE-2023-49082, https://ubuntu.com/security/CVE-2024-23829, https://ubuntu.com/security/CVE-2024-27306, https://ubuntu.com/security/CVE-2024-30251, https://ubuntu.com/security/CVE-2024-52304