aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10     branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br`     extension) are vulnerable to path traversal outside the root directory if those variants are symbolic     links. The server protects static routes from path traversal outside the root directory when     `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and     then checking that path relative to the root. However, these checks are not performed when looking for     compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when     performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the     issue. (CVE-2024-42367)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10
    branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br`
    extension) are vulnerable to path traversal outside the root directory if those variants are symbolic
    links. The server protects static routes from path traversal outside the root directory when
    `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and
    then checking that path relative to the root. However, these checks are not performed when looking for
    compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when
    performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the
    issue. (CVE-2024-42367)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3110-1 advisory.

    - CVE-2024-42367: Fixed path traversal outside the root directory when requests involve compressed files     as symbolic links (bsc#1229226)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
228929	Linux Distros Unpatched Vulnerability : CVE-2024-42367	Nessus	Misc.	medium
416608	SCA: security update for aiohttp (GHSA-jwhx-xcg6-8xhj)	Tenable Cloud Security	SCA Checks	medium
416608	SCA: security update for aiohttp (GHSA-jwhx-xcg6-8xhj)	Tenable Self-Hosted Container Security	SCA Checks	medium
206563	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2024:3110-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-42367

medium

Tenable Plugins

medium

medium

medium

medium