CVE-2021-21330
published 2021-02-26CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.91%
77.5th percentile
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.7.4 | 3.7.4 |
| aiohttp | aiohttp | < 3.7.4 | 3.7.4 |
| aiohttp | aiohttp | >= 0 < 3.8.0 | 3.8.0 |
| aiohttp | aiohttp | >= 0 < 3.7.4 | 3.7.4 |
| debian | debian_linux | — | — |
| debian | python-aiohttp | < python-aiohttp 3.7.4-1 (bookworm) | python-aiohttp 3.7.4-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_debian3.1LOW
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
ghsa·2023-11-14·CVSS 6.1
CVE-2023-47641 [MEDIUM] CWE-444 Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
### Impact
Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation.
A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfil
OSV
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
osv·2023-11-14·CVSS 6.1
CVE-2023-47641 [MEDIUM] Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
### Impact
Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation.
A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfil
OSV
CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
osv·2021-02-26·CVSS 6.1
CVE-2021-21330 [MEDIUM] CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
OSV
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
osv·2021-02-26
CVE-2021-21330 [LOW] `aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
### Impact
Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.
### Patches
This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
[`pip install aiohttp >= 3.7.4`]
### Workarounds
If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
### References
* [aiohttp @ PyPI]
* [GHSA-v6wp-4m6f-gcjg]
* [OWASP page on open redirects]
### For more information
If you have any questions or comments about this advisory:
GHSA
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
ghsa·2021-02-26
CVE-2021-21330 [LOW] CWE-601 `aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
### Impact
Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.
### Patches
This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
[`pip install aiohttp >= 3.7.4`]
### Workarounds
If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
### References
* [aiohttp @ PyPI]
* [GHSA-v6wp-4m6f-gcjg]
* [OWASP page on open redirects]
### For more information
If you have any questions or comments about this advisory:
Ubuntu
AIOHTTP vulnerability
vendor_ubuntu·2022-04-21
CVE-2021-21330 AIOHTTP vulnerability
Title: AIOHTTP vulnerability
Summary: AIOHTTP could be used to perform an open redirect attack.
Jelmer Vernooij and Beast Glatisant discovered that AIOHTTP incorrectly
handled certain URLs, leading to an open redirect attack. A remote
attacker could possibly use this issue to perform phishing attacks.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
vendor_redhat·2021-02-25·CVSS 3.1
CVE-2021-21330 [LOW] CWE-601 python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
An open redirect flaw was found in python-aiohttp. This flaw allows a remote, unauthenti
Debian
CVE-2021-21330: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2021·CVSS 3.1
CVE-2021-21330 [LOW] CVE-2021-21330: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Scope: local
bookworm: resolved (fixed in 3.7.4-1)
bullseye: resolved (fixed in 3.7.4-1)
forky: resolved (fixed in 3.7.4-1)
sid: resolved (fixed in 3.7.4-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96bhttps://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/https://pypi.org/project/aiohttp/https://security.gentoo.org/glsa/202208-19https://www.debian.org/security/2021/dsa-4864https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96bhttps://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/https://pypi.org/project/aiohttp/https://security.gentoo.org/glsa/202208-19https://www.debian.org/security/2021/dsa-4864
2021-02-26
Published