huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-46233: crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
Component: crypto-js
Severity: Important
CWE: CWE-916 (Use of Password Hash With Insufficient Computational Effort)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2023-10-25T00:00:00+00:00

A vulnerability was found in crypto-js in how PBKDF2 is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This issue is because both default to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and default to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on the iteration count as a countermeasure to preimage and collision attacks.

Statement: The vulnerability in crypto-js's PBKDF2 implementation represents a important CVE issue due to its fundamental impact on cryptographic security. PBKDF2 is widely used for password protection and signature generation, making it a core component of many security-critical systems. However, the default settings in crypto-js result in significantly weaker security than industry standards, with the algorithm being 1,000 times weaker than originally specified in 1993 and millions of times weaker than current recommendations. This weakness stems from the use of the insecure SHA1 hash algorithm and the default of only one iteration, both of which greatly diminish the resistance against various attacks. Consequently, attackers can exploit this vulnerability to create identical cryptographic signatures, potentially gaining unauthorized access to sensitive information or compromising system integrity. Given the widespread use of crypto-js and the important role of PBKDF2 in cryptographic operations, addressing this vulnerability is paramount to safeguarding against security breaches and maintaining trust in digital systems.

Affected upstream versions: < 4.2.0
Fixed upstream versions: 4.2.0
Upstream repository: https://github.com/brix/crypto-js
Upstream fix commit: 421dd538b2d34e7c24a5b72cc64dc2b9167db40a
CVE-2023-46234: browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack
Component: browserify-sign
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-10-26T00:00:00+00:00

A flaw was found in browserify-sign node package. This issue may allow a malicious user to execute a signature forgery attack by not correctly checking cryptographic signatures for DSA data, resulting in a jeopardized environment.

Statement: An attacker could impact the integrity of a server when handling unknown input due to the lack of DSA verification, for example, pretending to be a legitimate user, gaining unauthorized access. Therefore, the impact for this vulnerability is important.

Red Hat Fuse 7 uses browserify-sign as a transitive development dependency, hence the Low impact.

Affected upstream versions: >= 2.6.0, <= 4.2.1
Fixed upstream versions: v4.2.2
Upstream repository: https://github.com/browserify/browserify-sign
Upstream fix commit: 85994cd6348b50f2fd1b73c54e20881416f44a30
CVE-2023-46724: squid: Denial of Service in SSL Certificate validation
Component: squid
Severity: Important
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-11-01T00:00:00+00:00

A flaw was found in Squid. Due to an improper validation of the specified index bug, Squid compiled using `--with-openssl` is vulnerable to a denial of service attack against SSL Certificate validation. This flaw allows a remote server to perform a denial of service against the Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump.


Affected upstream versions: >= 3.3.0.1, < 6.4
Fixed upstream versions: SQUID_7_0_1
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: b70f864940225dfe69f9f653f948e787f99c3810
CVE-2023-46728: squid: NULL pointer dereference in the gopher protocol code
Component: squid
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-26T00:00:00+00:00

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid. This issue may lead to a remote denial of service via gopher URL requests.


Affected upstream versions: < 6.0.1
Fixed upstream versions: SQUID_6_0_1
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: 6ea12e8fb590ac6959e9356a81aa3370576568c3
CVE-2023-46751: ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
Component: ghostscript
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-12-06T00:00:00+00:00

A flaw was found in Ghostscript. A remote attacker may use a specially crafted payload to trigger access to previously freed memory, which can potentially lead to remote code execution or an application crash.

Statement: The discovered vulnerability in the function gdev_prn_open_printer_seekable() within Artifex Ghostscript, poses a moderate severity threat due to its potential to cause a denial-of-service (DoS) condition. Exploiting this flaw involves manipulating a dangling pointer, which can lead to crashing the application. While the impact is limited to crashing the application, the exploit requires remote access, which elevates the risk compared to local-only vulnerabilities.

Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.03.0
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: dcdbc595c13c9d11d235702dff46bb74c80f7698
CVE-2023-46752: frr: mishandled malformed data leading to a crash
Component: frr
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-10-26T00:00:00+00:00

A data mishandling vulnerability was found in FRRouting. A malformed MP_REACH_NLRI data can lead to a crash, resulting in a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: frr-10.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: b08afc81c60607a4f736f418f2e3eb06087f1a35
CVE-2023-46753: frr: crafted BGP UPDATE message leading to a crash
Component: frr
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-10-26T00:00:00+00:00

A flaw was found in FRRouting. A crash can occur for a crafted BGP UPDATE message without mandatory attributes (for example, one with only an unknown transit attribute).


Affected upstream versions: n/a
Fixed upstream versions: frr-10.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: d8482bf011cb2b173e85b65b4bf3d5061250cdb9
CVE-2023-46813: kernel: SEV-ES local priv escalation
Component: kernel
Severity: Moderate
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-10-27T00:00:00+00:00

A buffer overflow and null pointer dereference flaw was found in the Linux kernel's Secure Encrypted Virtualization (SEV) implementation for AMD functionality. This issue occurs when a user in SEV guest VM accesses MMIO registers, which could allow a local user to crash the system or escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 63e44bc52047f182601e7817da969a105aa1f721
CVE-2023-46862: kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-10-29T00:00:00+00:00

A null pointer dereference flaw was found in the Linux kernel's io_uring functionality. This issue could allow a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 7644b1a1c9a7ae8ab99175989bfc8676055edb46
CVE-2023-47038: perl: Write past buffer end via illegal user-defined Unicode property
Component: perl
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-11-25T00:00:00+00:00

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

Statement: For this vulnerability in Perl, a successful exploitation may involve navigating through intricate aspects of the code related to user-defined Unicode properties and executing an attack that writes past the buffer end. So the higher attack complexity implies that it would be more challenging for an attacker to exploit this vulnerability successfully, requiring a greater level of sophistication and effort. Due to this elevated level of difficulty, the vulnerability has been marked with a moderate severity rating.

Affected upstream versions: 5.30.0 < 5.34.3, 5.36.0 < 5.36.3, 5.38.0 < 5.38.2
Fixed upstream versions: 4:5.32.1-481.el9, 5.34.3, 5.36.3, 5.38.2, 8100020240314121426.9fe1d287
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: ff1f9f59360afeebd6f75ca1502f5c3ebf077da3
CVE-2023-47108: opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics
Component: opentelemetry-go-contrib
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-11-10T00:00:00+00:00

A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system.

Statement: While no authentication is required, there are a significant number of non-default factors that prevent widespread exploitation of this issue. To affect a service, all of the following must be true:
- The go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc package must be in use
- Configured a metrics pipeline that uses the UnaryServerInterceptor wrapper function
- No filtering of unknown HTTP methods or user agents at a higher level, such as Content Delivery Network

Due to the limited attack surface, Red Hat Product Security rates the impact of this flaw as Moderate.

cluster-network-operator-container in Openshift Container Platform 4 is rated as low and Won't Fix as the stats are behind an RBAC proxy and isn't available to unauthenticated users.

Affected upstream versions: >= 0.37.0, < 0.46.0
Fixed upstream versions: bridges/otelslog/v0.0.1
Upstream repository: https://github.com/open-telemetry/opentelemetry-go-contrib
Upstream fix commit: 04c5dcbb5b35f14b4e6793b245919c72addbc7d0
CVE-2023-47234: frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
Component: frr
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-11-03T00:00:00+00:00

A flaw was found in frr. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data that lacks mandatory path attributes.

Statement: Red Hat OpenStack Platform does not ship its own version of the frr package, instead using the version from the underlying Red Hat Enterprise Linux. RHOSP is marked as Not Affected as no changes need to be made by the OpenStack engineering team. System administrators of OpenStack deployments should apply updates once available in RHEL.

Affected upstream versions: n/a
Fixed upstream versions: frr-10.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: c37119df45bbf4ef713bc10475af2ee06e12f3bf
CVE-2023-47235: frr: crash from malformed EOR-containing BGP UPDATE message
Component: frr
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-11-03T00:00:00+00:00

An issue was found in FRRouting FRR, where a crash may occur when processing a malformed BGP UPDATE message with an EOR.

Statement: A moderate severity issue has been identified in FRRouting FRR, where a crash may occur when processing a malformed BGP UPDATE message with an EOR. It's important to note that Red Hat OpenStack Platform (RHOSP) is not directly affected, as it utilises the version from the underlying Red Hat Enterprise Linux and is marked as Not Affected, with no changes required by the OpenStack engineering team. However, system administrators of OpenStack deployments are advised to apply updates once available in RHEL to mitigate potential risks. Additionally, this flaw is discovered through fuzzing, where, in normal cases, such packets cannot exist.

Affected upstream versions: n/a
Fixed upstream versions: frr-10.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: 6814f2e0138a6ea5e1f83bdd9085d9a77999900b
CVE-2023-4727: ca: token authentication bypass vulnerability
Component: ca
Severity: Important
CWE: CWE-305 (Authentication Bypass by Primary Weakness)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-06-11T00:00:00+00:00

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.


Affected upstream versions: <= v11.5.0
Fixed upstream versions: 0:10.5.18-32.el7_9, 0:11.0.6-3.el9_0, 0:11.3.0-2.el9_2, 0:11.5.0-2.el9_4, 11.5.1, 8040020240329193548.17df0a3f, 8060020240329182634.60523a7b, 8060020240529205458.07fb4edf, 8080020240329143735.693a3987, 8100020240614102443.82f485b7
Upstream repository: https://github.com/dogtagpki/pki
Upstream fix commit: 54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720
CVE-2023-4752: vim: use-after-free in function ins_compl_get_exp in vim/vim
Component: vim
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-09-04T00:00:00+00:00

A flaw was found in Vim, where it is vulnerable to a use-after-free in the ins_compl_get_exp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Affected upstream versions: unspecified < 9.0.1858
Fixed upstream versions: 9.0.1858
Upstream repository: https://github.com/vim/vim
Upstream fix commit: ee9166eb3b41846661a39b662dc7ebe8b5e15139
CVE-2023-4759: jgit: arbitrary file overwrite
Component: jgit
Severity: Moderate
Public date: 2023-09-12T00:00:00+00:00

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0

In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.

This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.

The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.

Setting git configuration option core.symlinks = false before checking out avoids the problem.

The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via  Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and  repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from  5.13.3.202401111512-r.


The JGit maintainers would like to thank RyotaK for finding and reporting this issue.






Affected upstream versions: 0.0.0 <= 6.6.0.202305301015-r
Fixed upstream versions:   5.13.3.202401111512-r
Upstream repository: https://git.eclipse.org/c/jgit/jgit.git
Upstream fix commit: 9072103f3b3cf64dd12ad2949836ab98f62dabf1
CVE-2023-47627: python-aiohttp: numerous issues in HTTP parser with header parsing
Component: python-aiohttp
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-11-15T00:00:00+00:00

An HTTP request smuggling vulnerability was found in aiohttp. Numerous issues with HTTP parsing can allow an attacker to smuggle HTTP requests.


Affected upstream versions: < 3.8.6
Fixed upstream versions: v3.8.6
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: d5c12ba890557a575c313bb3017910d7616fce3d
CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec
Component: libwebp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2023-09-11T00:00:00+00:00

A heap-based buffer flaw was found in the way libwebp, a library used to process "WebP" image format data, processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute remotely arbitrary code in an application such as a web browser compiled with this library.

Statement: This security issue has been classified as having an Important security impact. Desktop users are at a high risk of exploitation of this flaw with very minimal interaction. It may compromise the confidentiality, integrity, or availability of resources.

Customers using this application, which does server-side image processing by linking to the libwebp library, are also potentially impacted by this flaw and are advised to update to the fixed versions of the package.

Affected upstream versions: 116.0.5845.187 < 116.0.5845.187, 1.3.2 < 1.3.2
Fixed upstream versions: 1.3.2, 116.0.5845.187
Upstream repository: https://github.com/webmproject/libwebp
Upstream fix commit: 902bc9190331343b2017211debcec8d2ab87e17a
CVE-2023-4874: mutt: null pointer dereference
Component: mutt
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-09-09T00:00:00+00:00

A null pointer dereference flaw was found in mutt when handling specially crafted characters. This issue could allow an attacker to send a specially crafted email that causes the email client to crash when reading or processing the email.

Statement: This is a local client crash caused by a specially crafted email. No code execution is expected. This flaw has been rated as having moderate security impact.

Affected upstream versions: 1.5.2 < 2.2.12
Fixed upstream versions: 2.2.12
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 452ee330e094bfc7c9a68555e5152b1826534555
CVE-2023-4875: mutt: null pointer dereference
Component: mutt
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-09-09T00:00:00+00:00

A null pointer dereference flaw was found in mutt when handling specially crafted characters. This issue could allow an attacker to send a specially crafted email that causes the email client to crash when reading or processing the email.

Statement: This is a local client crash caused by a specially crafted email. No code execution is expected. This flaw has been rated as having moderate security impact.

Affected upstream versions: 1.5.2 < 2.2.12
Fixed upstream versions: 2.2.12
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 452ee330e094bfc7c9a68555e5152b1826534555
CVE-2023-48795: ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
Component: ssh
Severity: Moderate
CWE: CWE-222 (Truncation of Security-relevant Information)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-12-18T00:00:00+00:00

A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure in OpenSSH 9.5 against keystroke timing attacks.

Statement: This CVE is classified as moderate because the attack requires an active Man-in-the-Middle (MITM) who can intercept and modify the connection's traffic at the TCP/IP layer.

Although the attack is cryptographically innovative, its security impact is fortunately quite limited. It only allows the deletion of consecutive messages, and deleting most messages at this protocol stage prevents user authentication from proceeding, leading to a stalled connection.

The most significant identified impact is that it enables a MITM to delete the SSH2_MSG_EXT_INFO message sent before authentication begins. This allows the attacker to disable a subset of keystroke timing obfuscation features. However, there is no other observable impact on session secrecy or session integrity.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/TeraTermProject/teraterm
Upstream fix commit: 7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0
CVE-2023-49081: aiohttp: HTTP request modification
Component: aiohttp
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2023-11-30T00:00:00+00:00

A flaw was found in the python-aiohttp package. This issue could allow a remote attacker to modify an existing HTTP request or create a new request that could have minor confidentiality or integrity impacts.


Affected upstream versions: < 3.9.0
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 1e86b777e61cf4eefc7d92fa57fa19dcc676013b
CVE-2023-49082: aiohttp: CRLF injection if user controls the HTTP method using aiohttp client
Component: aiohttp
Severity: Low
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-11-29T00:00:00+00:00

A flaw was found in Aiohttp. This issue may allow an attacker to send a crafted HTTP request to the server and smuggle arbitrary HTTP headers due to improper validation of HTTP requests during the processing of the HTTP request method. By exploiting this flaw, an attacker can manipulate HTTP requests and potentially poison the HTTP cache for phishing attacks.

Statement: The vulnerability only occurs if the attacker can control the HTTP method (GET, POST etc.) of the request.

Affected upstream versions: < 3.9.0
Fixed upstream versions: v3.9.0
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: e4ae01c2077d2cfa116aa82e4ff6866857f7c466