aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect an attacker could combine it to redirect random users to another website and log the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of     aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol.
    HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are     present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison     other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a     configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend.
    As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore     this header and will parse Content-Length. The impact of this vulnerability is that it is possible to     bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is     present an Open Redirect an attacker could combine it to redirect random users to another website and log     the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2023-47641)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4041 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4041-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     February 03, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.7.4-1+deb11u1     CVE ID         : CVE-2023-47627 CVE-2023-47641 CVE-2023-49081 CVE-2023-49082                      CVE-2024-23334 CVE-2024-23829 CVE-2024-27306 CVE-2024-30251                      CVE-2024-52304     Debian Bug     :

    Several issues have been found in aiohttp, an asynchronous HTTP     client/server framework for asyncio and Python. Those issues are related     to the HTTP parser, link traversal and XSS on the index pages.

    CVE-2023-47627

         The HTTP parser in AIOHTTP has numerous problems with header          parsing, which could lead to request smuggling. This parser is only          used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt          wheel).

    CVE-2023-47641

        Affected versions of aiohttp have a security vulnerability regarding         the inconsistent interpretation of the http protocol. HTTP/1.1 is a         persistent protocol, if both Content-Length(CL) and         Transfer-Encoding(TE) header values are present it can lead to         incorrect interpretation of two entities that parse the HTTP and we         can poison other sockets with this incorrect interpretation. A         possible Proof-of-Concept (POC) would be a configuration with a         reverse proxy(frontend) that accepts both CL and TE headers and         aiohttp as backend. As aiohttp parses anything with chunked, we can         pass a chunked123 as TE, the frontend entity will ignore this header         and will parse Content-Length. The impact of this vulnerability is         that it is possible to bypass any proxy rule, poisoning sockets to         other users like passing Authentication Headers, also if it is         present an Open Redirect an attacker could combine it to redirect         random users to another website and log the request.

    CVE-2023-49081

        Improper validation made it possible for an attacker to modify the         HTTP request (e.g. to insert a new header) or create a new HTTP         request if the attacker controls the HTTP version. The vulnerability         only occurs if the attacker can control the HTTP version of the         request.

    CVE-2023-49082

        Improper validation makes it possible for an attacker to modify the         HTTP request (e.g. insert a new header) or even create a new HTTP         request if the attacker controls the HTTP method. The vulnerability         occurs only if the attacker can control the HTTP method (GET, POST         etc.) of the request. If the attacker can control the HTTP version         of the request it will be able to modify the request (request         smuggling).

    CVE-2024-23334

        When using aiohttp as a web server and configuring static routes, it         is necessary to specify the root path for static files.
        Additionally, the option 'follow_symlinks' can be used to determine         whether to follow symbolic links outside the static root directory.
        When 'follow_symlinks' is set to True, there is no validation to         check if reading a file is within the root directory. This can lead         to directory traversal vulnerabilities, resulting in unauthorized         access to arbitrary files on the system, even when symlinks are not         present. Disabling follow_symlinks and using a reverse proxy are         encouraged mitigations.

    CVE-2024-23829

        Security-sensitive parts of the Python HTTP parser retained minor         differences in allowable character sets, that must trigger error         handling to robustly match frame boundaries of proxies in order to         protect against injection of additional requests. Additionally,         validation could trigger exceptions that were not handled         consistently with processing of other malformed input. Being more         lenient than internet standards require could, depending on         deployment environment, assist in request smuggling. The unhandled         exception could cause excessive resource consumption on the         application server and/or its logging facilities.

    CVE-2024-27306

        A XSS vulnerability exists on index pages for static file handling.

    CVE-2024-30251

         In affected versions an attacker can send a specially crafted POST          (multipart/form-data) request. When the aiohttp server processes          it, the server will enter an infinite loop and be unable to process          any further requests. An attacker can stop the application from          serving requests after sending a single request.

    CVE-2024-52304

        The Python parser parses newlines in chunk extensions incorrectly         which can lead to request smuggling vulnerabilities under certain         conditions. If a pure Python version of aiohttp is installed (i.e.
        without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is         enabled, then an attacker may be able to execute a request smuggling         attack to bypass certain firewalls or proxy protections.

    For Debian 11 bullseye, these problems have been fixed in version     3.7.4-1+deb11u1.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of
    aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol.
    HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are
    present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison
    other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a
    configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend.
    As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore
    this header and will parse Content-Length. The impact of this vulnerability is that it is possible to
    bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is
    present an Open Redirect an attacker could combine it to redirect random users to another website and log
    the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to
    upgrade. There are no known workarounds for this vulnerability. (CVE-2023-47641)

The remote host is affected by the vulnerability described in GLSA-202408-11 (aiohttp: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in aiohttp. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0577-1 advisory.

    python-aiohttp was updated to version 3.9.3:

    * Fixed backwards compatibility breakage (in 3.9.2) of ``ssl`` parameter       when set outside of ``ClientSession`` (e.g. directly in ``TCPConnector``)
    * Improved test suite handling of paths and temp files to consistently       use pathlib and pytest fixtures.

    From version 3.9.2 (bsc#1219341, CVE-2024-23334, bsc#1219342, CVE-2024-23829):

    * Fixed server-side websocket connection leak.
    * Fixed ``web.FileResponse`` doing blocking I/O in the event loop.
    * Fixed double compress when compression enabled and compressed file       exists in server file responses.
    * Added runtime type check for ``ClientSession`` ``timeout`` parameter.
    * Fixed an unhandled exception in the Python HTTP parser on header lines       starting with a colon.
    * Improved validation of paths for static resources requests to the server.
    * Added support for passing :py:data:`True` to ``ssl`` parameter in       ``ClientSession`` while deprecating :py:data:`None`.
    * Fixed an unhandled exception in the Python HTTP parser on header lines       starting with a colon.
    * Fixed examples of ``fallback_charset_resolver`` function in the       :doc:`client_advanced` document.
    * The Sphinx setup was updated to avoid showing the empty       changelog draft section in the tagged release documentation       builds on Read The Docs.
    * The changelog categorization was made clearer. The contributors can       now mark their fragment files more accurately.
    * Updated :ref:`contributing/Tests coverage <aiohttp-contributing>`       section to show how we use ``codecov``.
    * Replaced all ``tmpdir`` fixtures with ``tmp_path`` in test suite.

    - Disable broken tests with openssl 3.2 and python < 3.11 bsc#1217782

    update to 3.9.1:

    * Fixed importing aiohttp under PyPy on Windows.
    * Fixed async concurrency safety in websocket compressor.
    * Fixed ``ClientResponse.close()`` releasing the connection       instead of closing.
    * Fixed a regression where connection may get closed during       upgrade. -- by :user:`Dreamsorcerer`
    * Fixed messages being reported as upgraded without an Upgrade       header in Python parser. -- by :user:`Dreamsorcerer`

    update to 3.9.0: (bsc#1217684, CVE-2023-49081, bsc#1217682, CVE-2023-49082)

    * Introduced ``AppKey`` for static typing support of       ``Application`` storage.
    * Added a graceful shutdown period which allows pending tasks       to complete before the application's cleanup is called.
    * Added `handler_cancellation`_ parameter to cancel web handler on       client disconnection.
    * This (optionally) reintroduces a feature removed in a       previous release.
    * Recommended for those looking for an extra level of       protection against denial-of-service attacks.
    * Added support for setting response header parameters       ``max_line_size`` and ``max_field_size``.
    * Added ``auto_decompress`` parameter to       ``ClientSession.request`` to override       ``ClientSession._auto_decompress``.
    * Changed ``raise_for_status`` to allow a coroutine.
    * Added client brotli compression support (optional with       runtime check).
    * Added ``client_max_size`` to ``BaseRequest.clone()`` to allow       overriding the request body size. -- :user:`anesabml`.
    * Added a middleware type alias       ``aiohttp.typedefs.Middleware``.
    * Exported ``HTTPMove`` which can be used to catch any       redirection request that has a location -- :user:`dreamsorcerer`.
    * Changed the ``path`` parameter in ``web.run_app()`` to accept       a ``pathlib.Path`` object.
    * Performance: Skipped filtering ``CookieJar`` when the jar is       empty or all cookies have expired.
    * Performance: Only check origin if insecure scheme and there       are origins to treat as secure, in       ``CookieJar.filter_cookies()``.
    * Performance: Used timestamp instead of ``datetime`` to       achieve faster cookie expiration in ``CookieJar``.
    * Added support for passing a custom server name parameter to       HTTPS connection.
    * Added support for using Basic Auth credentials from       :file:`.netrc` file when making HTTP requests with the
    * :py:class:`~aiohttp.ClientSession` ``trust_env`` argument is       set to ``True``. -- by :user:`yuvipanda`.
    * Turned access log into no-op when the logger is disabled.
    * Added typing information to ``RawResponseMessage``. -- by       :user:`Gobot1234`
    * Removed ``async-timeout`` for Python 3.11+ (replaced with       ``asyncio.timeout()`` on newer releases).
    * Added support for ``brotlicffi`` as an alternative to       ``brotli`` (fixing Brotli support on PyPy).
    * Added ``WebSocketResponse.get_extra_info()`` to access a       protocol transport's extra info.
    * Allow ``link`` argument to be set to None/empty in HTTP 451       exception.
    * Fixed client timeout not working when incoming data is always       available without waiting. -- by :user:`Dreamsorcerer`.
    * Fixed ``readuntil`` to work with a delimiter of more than one       character.
    * Added ``__repr__`` to ``EmptyStreamReader`` to avoid       ``AttributeError``.
    * Fixed bug when using ``TCPConnector`` with       ``ttl_dns_cache=0``.
    * Fixed response returned from expect handler being thrown       away. -- by :user:`Dreamsorcerer`
    * Avoided raising ``UnicodeDecodeError`` in multipart and in       HTTP headers parsing.
    * Changed ``sock_read`` timeout to start after writing has       finished, avoiding read timeouts caused by an unfinished       write. -- by :user:`dtrifiro`
    * Fixed missing query in tracing method URLs when using       ``yarl`` 1.9+.
    * Changed max 32-bit timestamp to an aware datetime object, for       consistency with the non-32-bit one, and to avoid a       ``DeprecationWarning`` on Python 3.12.
    * Fixed ``EmptyStreamReader.iter_chunks()`` never ending.
    * Fixed a rare ``RuntimeError: await wasn't used with future``       exception.
    * Fixed issue with insufficient HTTP method and version       validation.
    * Added check to validate that absolute URIs have schemes.
    * Fixed unhandled exception when Python HTTP parser encounters       unpaired Unicode surrogates.
    * Updated parser to disallow invalid characters in header field       names and stop accepting LF as a request line separator.
    * Fixed Python HTTP parser not treating 204/304/1xx as an empty       body.
    * Ensure empty body response for 1xx/204/304 per RFC 9112 sec       6.3.
    * Fixed an issue when a client request is closed before       completing a chunked payload. -- by :user:`Dreamsorcerer`
    * Edge Case Handling for ResponseParser for missing reason       value.
    * Fixed ``ClientWebSocketResponse.close_code`` being       erroneously set to ``None`` when there are concurrent async       tasks receiving data and closing the connection.
    * Added HTTP method validation.
    * Fixed arbitrary sequence types being allowed to inject values       via version parameter. -- by :user:`Dreamsorcerer`
    * Performance: Fixed increase in latency with small messages       from websocket compression changes.
    * Improved Documentation
    * Fixed the `ClientResponse.release`'s type in the doc. Changed       from `comethod` to `method`.
    * Added information on behavior of base_url parameter in       `ClientSession`.
    * Completed ``trust_env`` parameter description to honor       ``wss_proxy``, ``ws_proxy`` or ``no_proxy`` env.
    * Dropped Python 3.6 support.
    * Dropped Python 3.7 support. -- by :user:`Dreamsorcerer`
    * Removed support for abandoned ``tokio`` event loop.
    * Made ``print`` argument in ``run_app()`` optional.
    * Improved performance of ``ceil_timeout`` in some cases.
    * Changed importing Gunicorn to happen on-demand, decreasing       import time by ~53%. -- :user:`Dreamsorcerer`
    * Improved import time by replacing ``http.server`` with       ``http.HTTPStatus``.
    * Fixed annotation of ``ssl`` parameter to disallow ``True``.

    update to 3.8.6 (bsc#1217181, CVE-2023-47627):

    * Security bugfixes
    * https://github.com/aio-libs/aiohttp/security/advisories/GHSA-       pjjw-qhg8-p2p9.
    * https://github.com/aio-libs/aiohttp/security/advisories/GHSA-       gfw2-4jvh-wgfg.
    * Added ``fallback_charset_resolver`` parameter in       ``ClientSession`` to allow a user-supplied       character set detection function.
      Character set detection will no longer be included in 3.9 as       a default. If this feature is needed,       please use `fallback_charset_resolver       the client
    * Fixed ``PermissionError`` when ``.netrc`` is unreadable due       to permissions.
    * Fixed output of parsing errors
    * Fixed sorting in ``filter_cookies`` to use cookie with       longest path.

    Release 3.8.0 (2021-10-31) (bsc#1217174, CVE-2023-47641)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4909-1 advisory.

    - CVE-2023-47641: Fixed inconsistent interpretation of the http protocol, if           content-length and transport-encoding are in the same header with           transport-encoding value of 'chunked*' (bsc#1217174)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259356	Linux Distros Unpatched Vulnerability : CVE-2023-47641	Nessus	Misc.	medium
214900	Debian dla-4041 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	medium
420737	SCA: security update for aiohttp (GHSA-xx9p-xxvh-7g8j)	Tenable Cloud Security	SCA Checks	low
420737	SCA: security update for aiohttp (GHSA-xx9p-xxvh-7g8j)	Tenable Self-Hosted Container Security	SCA Checks	low
205141	GLSA-202408-11 : aiohttp: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
190879	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp, python-time-machine (SUSE-SU-2024:0577-1)	Nessus	SuSE Local Security Checks	high
187159	SUSE SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2023:4909-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2023-47641

low

Tenable Plugins

medium

medium

low

low

medium

high

low