Aio-Libs Aiohttp vulnerabilities

CVE-2024-27306 [MEDIUM] CWE-79 CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disab

CVE-2024-42367 [MEDIUM] CWE-61 CVE-2024-42367: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static route