Homepage
About Snyk

aiohttp-session@1.0.0 vulnerabilities

sessions for aiohttp.web

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the aiohttp-session package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insufficient Session Expiration

aiohttp-session provides sessions for aiohttp.web.

Affected versions of this package are vulnerable to Insufficient Session Expiration via the EncryptedCookieStorage and NaClCookieStorage functions that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

How to fix Insufficient Session Expiration?

Upgrade aiohttp-session to version 2.7.0 or higher.

[,2.7.0)
  • M
Session Fixation

aiohttp-session provides sessions for aiohttp.web.

Affected versions of this package are vulnerable to Session Fixation.

The Get session data function returns an empty dictionary for an empty or invalidated session. save_session takes this data and saves it in Redis.

As a result, an invalidated session will result to the session ID being present in Redis with an empty mapping as its value. If the key (session ID) is not present in Redis, RedisStorage's load_session function would only look at cases where data (returned by reading from Redis) is None. As a result the load_session function would return a session with the presented session ID and not a new one, although there was no valid session in storage for this ID.

##Remediation Upgrade aiohttp-session to version 2.4.0 or higher.

[,2.4.0)
Go back to all versions of this package