aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
References
Link | Resource |
---|---|
https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e | Exploit Third Party Advisory |
https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b | |
https://github.com/aio-libs/aiohttp/pull/7835/files | |
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2 | Exploit Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-11-30T06:56:26.348Z
Updated: 2024-01-29T14:10:37.384Z
Reserved: 2023-11-21T18:57:30.428Z
Link: CVE-2023-49081
JSON object: View
NVD Information
Status : Modified
Published: 2023-11-30T07:15:08.723
Modified: 2024-01-29T14:15:08.373
Link: CVE-2023-49081
JSON object: View
Redhat Information
No data.
CWE