aio-libs aiohttp up to 3.9.1 HTTP Parser request smuggling

Summaryinfo

A vulnerability marked as critical has been reported in aio-libs aiohttp up to 3.9.1. Affected is an unknown function of the component HTTP Parser. This manipulation causes request smuggling. This vulnerability is handled as CVE-2024-23829. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in aio-libs aiohttp up to 3.9.1. Affected by this vulnerability is an unknown code of the component HTTP Parser. The manipulation with an unknown input leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect integrity, and availability. The summary by CVE is:

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.

The weakness was released 01/30/2024 as GHSA-8qpw-xqxj-h4r2. The advisory is shared at github.com. This vulnerability is known as CVE-2024-23829 since 01/22/2024. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214900 (Debian dla-4041 : python-aiohttp-doc - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.9.2 eliminates this vulnerability. Applying the patch 33ccdfb0a12690af5bb49bda2319ec0907fa7827 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (214900) and CERT Bund (WID-SEC-2024-0949). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Fedora Linux
• Red Hat Enterprise Linux
• Red Hat Satellite
• IBM MQ

Productinfo

Vendor

• aio-libs

Name

• aiohttp

Version

• 3.9.0
• 3.9.1

License

• open-source

Website

• Product: https://github.com/aio-libs/aiohttp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion