REDHAT-BUG-2380000: Low severity pypi/aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.12.14 - Configuration
Enable AIOHTTP_NO_EXTENSIONS to avoid using the pure-Python path that is vulnerable to HTTP request smuggling prior to aiohttp 3.12.14.
aiohttp AIOHTTP_NO_EXTENSIONS = enabled (True)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2380000?
The severity of REDHAT-BUG-2380000 is considered high due to its potential for HTTP request smuggling, leading to significant security implications.
How do I fix REDHAT-BUG-2380000?
To fix REDHAT-BUG-2380000, upgrade the aiohttp package to version 3.12.14 or higher where the vulnerability has been addressed.
What versions of aiohttp are affected by REDHAT-BUG-2380000?
Versions of aiohttp prior to 3.12.14 are affected by REDHAT-BUG-2380000.
What type of vulnerability is REDHAT-BUG-2380000?
REDHAT-BUG-2380000 is a request smuggling vulnerability that arises from improper parsing of HTTP request trailer sections.
What is the main consequence of REDHAT-BUG-2380000?
The main consequence of REDHAT-BUG-2380000 is that it allows attackers to manipulate HTTP requests, potentially leading to unauthorized actions or data exposure.