CVE-2023-49082

CVSS V2 None CVSS V3 None

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

Overview

CVE ID
CVE-2023-49082

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-11-29T20:07:29.341Z

Last Modified Date
2024-01-29T14:11:02.945Z

Weakness Enumerations

CWE	URL
CWE-93	http://cwe.mitre.org/data/definitions/93.html
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/pull/7806/files	x_refsource_MISC
https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466	x_refsource_MISC
https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-49082
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49082

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 12:56:00				Added to TrackCVE