GHSA-f9xw-jh8m-3mwq: Pip/aiohttp vulnerability
Summary
An attacker sending an absolute-form request can spoof the scheme used.
Impact
If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.
Workaround
A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Compensating control
Configure a WAF rule to reject absolute-form requests; legitimate requests should use absolute-form only when acting as proxies.
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications are exposed when their code uses the Request.scheme attribute for security-relevant decisions. This can allow an attacker to bypass logic that depends on whether a connection is considered encrypted.
What does an attacker need to send to exploit the issue?
The attacker needs to send an absolute-form HTTP request. This can cause the application to see a spoofed scheme value.
What can be done if patching is not immediately possible?
Configure a WAF rule to reject absolute-form requests. Legitimate clients should use this request form only when communicating with proxies.