REDHAT-BUG-2427256: Medium severity pypi/aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3 - Compensating control
If upgrades are not immediately possible, avoid running with Python optimizations enabled (do not use -O or PYTHONOPTIMIZE=1) when the application includes a handler that uses the Request.post() method.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2427256?
The severity of REDHAT-BUG-2427256 is classified as medium with a rating of 4.
How do I fix REDHAT-BUG-2427256?
To fix REDHAT-BUG-2427256, update AIOHTTP to version 3.13.3 or later where the vulnerability is addressed.
What type of attack does REDHAT-BUG-2427256 allow for?
REDHAT-BUG-2427256 allows for a Denial of Service (DoS) attack when processing a POST body.
What versions of AIOHTTP are affected by REDHAT-BUG-2427256?
AIOHTTP versions 3.13.2 and below are affected by REDHAT-BUG-2427256.
What conditions exacerbate the impact of REDHAT-BUG-2427256?
The impact of REDHAT-BUG-2427256 is exacerbated when optimizations are enabled, using flags like -O or PYTHONOPTIMIZE=1.