CVE-2018-1000814: Medium severity aiohttp-session vulnerability
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000814?
CVE-2018-1000814 is classified as a moderate severity vulnerability due to its potential for allowing non-expiring sessions.
How do I fix CVE-2018-1000814?
To fix CVE-2018-1000814, upgrade aiohttp-session to version 2.7.0 or later.
What versions are affected by CVE-2018-1000814?
CVE-2018-1000814 affects aiohttp-session versions up to and including 2.6.0.
What type of vulnerability is CVE-2018-1000814?
CVE-2018-1000814 is an Other/Unknown vulnerability that affects session management.
Can CVE-2018-1000814 lead to unauthorized access?
Yes, if exploited, CVE-2018-1000814 can result in unauthorized access due to non-expiring sessions.