Inconsistent Interpretation of HTTP Messages Affecting aiohttp package, versions [,3.8.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-AIOHTTP-6057352
- published 15 Nov 2023
- disclosed 14 Nov 2023
- credit chinchila
Introduced: 14 Nov 2023
CVE-2023-47641 Open this link in a new tabHow to fix?
Upgrade aiohttp to version 3.8.0 or higher.
Overview
Affected versions of this package are vulnerable to Inconsistent Interpretation of HTTP Messages due to the inconsistent interpretation of Content-Length vs. Transfer-Encoding in both C and Python fallbacks. An attacker can bypass proxy rules and poison sockets to other users, potentially passing Authentication Headers.
Note:
This is only exploitable if a configuration with a reverse proxy that accepts both Content-Length and Transfer-Encoding headers and aiohttp as backend is present.
Additionally, if an Open Redirect is present, it can be combined to redirect random users to an attacker's website and log the request.