Improper Input Validation Affecting aiohttp package, versions [,3.9.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-AIOHTTP-6091622
- published 28 Nov 2023
- disclosed 27 Nov 2023
- credit jnovikov
Introduced: 27 Nov 2023
CVE-2023-49081 Open this link in a new tabHow to fix?
Upgrade aiohttp to version 3.9.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation in the ClientSession. An attacker can modify the HTTP request or create a new HTTP request by controlling the HTTP version of the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.
Note: The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).
Workaround
If these specific conditions are met and you are unable to upgrade, then validate the user input to the version parameter to ensure it is a str.