Vulnerability · Published Jan 29, 2024 · Assigned by GitHub_M
CVE-2024-23829aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Medium 6.5
In plain English
A medium-severity security flaw in aiohttp from aio-libs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | py3-aiohttp | 3.9.3-r0 | ALPINE-CVE-2024-23829 |
| Alpine:v3.21 | py3-aiohttp | 3.9.3-r0 | ALPINE-CVE-2024-23829 |
| Alpine:v3.22 | py3-aiohttp | 3.9.3-r0 | ALPINE-CVE-2024-23829 |
| Alpine:v3.23 | py3-aiohttp | 3.9.3-r0 | ALPINE-CVE-2024-23829 |
| Alpine:v3.24 | py3-aiohttp | 3.9.3-r0 | ALPINE-CVE-2024-23829 |
| Debian:12 | python-aiohttp | no fix listed | DEBIAN-CVE-2024-23829 |
| Debian:13 | python-aiohttp | 3.9.5-1 | DEBIAN-CVE-2024-23829 |
| Debian:14 | python-aiohttp | 3.9.5-1 | DEBIAN-CVE-2024-23829 |
| PyPI | aiohttp | 3.9.2 | PYSEC-2024-26 |
| PyPI | aiohttp | 3.9.2 | GHSA-8qpw-xqxj-h4r2 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2 x_refsource_CONFIRM
- https://github.com/aio-libs/aiohttp/pull/8074 x_refsource_MISC
- https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html