pysec - pysec-2023-250

PYSEC-2023-250

Vulnerability from pysec - Published: 2023-11-30 07:15 - Updated: 2024-01-29 16:22

Details

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impacted products

Name	purl
aiohttp	pkg:pypi/aiohttp

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiohttp",
        "purl": "pkg:pypi/aiohttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1e86b777e61cf4eefc7d92fa57fa19dcc676013b"
            }
          ],
          "repo": "https://github.com/aio-libs/aiohttp",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.11.0",
        "0.12.0",
        "0.13.0",
        "0.13.1",
        "0.14.0",
        "0.14.1",
        "0.14.2",
        "0.14.3",
        "0.14.4",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.15.3",
        "0.16.0",
        "0.16.1",
        "0.16.2",
        "0.16.3",
        "0.16.4",
        "0.16.5",
        "0.16.6",
        "0.17.0",
        "0.17.1",
        "0.17.2",
        "0.17.3",
        "0.17.4",
        "0.18.0",
        "0.18.1",
        "0.18.2",
        "0.18.3",
        "0.18.4",
        "0.19.0",
        "0.2",
        "0.20.0",
        "0.20.1",
        "0.20.2",
        "0.21.0",
        "0.21.1",
        "0.21.2",
        "0.21.4",
        "0.21.5",
        "0.21.6",
        "0.22.0",
        "0.22.0a0",
        "0.22.0b0",
        "0.22.0b1",
        "0.22.0b2",
        "0.22.0b3",
        "0.22.0b4",
        "0.22.0b5",
        "0.22.0b6",
        "0.22.1",
        "0.22.2",
        "0.22.3",
        "0.22.4",
        "0.22.5",
        "0.3",
        "0.4",
        "0.4.1",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.5.0",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.5",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.1.6",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "2.0.0",
        "2.0.0rc1",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.0.7",
        "2.1.0",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.2.3",
        "2.2.4",
        "2.2.5",
        "2.3.0",
        "2.3.0a1",
        "2.3.0a2",
        "2.3.0a3",
        "2.3.0a4",
        "2.3.1",
        "2.3.10",
        "2.3.1a1",
        "2.3.2",
        "2.3.2b2",
        "2.3.2b3",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.3.9",
        "3.0.0",
        "3.0.0b0",
        "3.0.0b1",
        "3.0.0b2",
        "3.0.0b3",
        "3.0.0b4",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.2.0",
        "3.2.1",
        "3.3.0",
        "3.3.0a0",
        "3.3.1",
        "3.3.2",
        "3.3.2a0",
        "3.4.0",
        "3.4.0a0",
        "3.4.0a3",
        "3.4.0b1",
        "3.4.0b2",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.5.0",
        "3.5.0a1",
        "3.5.0b1",
        "3.5.0b2",
        "3.5.0b3",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.5.4",
        "3.6.0",
        "3.6.0a0",
        "3.6.0a1",
        "3.6.0a11",
        "3.6.0a12",
        "3.6.0a2",
        "3.6.0a3",
        "3.6.0a4",
        "3.6.0a5",
        "3.6.0a6",
        "3.6.0a7",
        "3.6.0a8",
        "3.6.0a9",
        "3.6.0b0",
        "3.6.1",
        "3.6.1b3",
        "3.6.1b4",
        "3.6.2",
        "3.6.2a0",
        "3.6.2a1",
        "3.6.2a2",
        "3.6.3",
        "3.7.0",
        "3.7.0b0",
        "3.7.0b1",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.7.4.post0",
        "3.8.0",
        "3.8.0a7",
        "3.8.0b0",
        "3.8.1",
        "3.8.2",
        "3.8.3",
        "3.8.4",
        "3.8.5",
        "3.8.6",
        "3.9.0b0",
        "3.9.0b1",
        "3.9.0rc0"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49081",
    "GHSA-q3qx-c6g2-7pw2"
  ],
  "details": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.",
  "id": "PYSEC-2023-250",
  "modified": "2024-01-29T16:22:26.409794+00:00",
  "published": "2023-11-30T07:15:00+00:00",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"
    },
    {
      "type": "EVIDENCE",
      "url": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/pull/7835/files"
    },
    {
      "type": "FIX",
      "url": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q3QX-C6G2-7PW2

Vulnerability from github – Published: 2023-11-27 23:17 – Updated: 2025-11-03 22:32

Summary

aiohttp's ClientSession is vulnerable to CRLF injection via version

Details

Summary

Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.

Details

The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the version parameter. Furthermore, the vulnerability only occurs when the Connection header is passed to the headers parameter.

At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.

PoC

The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e

Impact

CRLF injection leading to Request Smuggling.

Workaround

If these specific conditions are met and you are unable to upgrade, then validate the user input to the version parameter to ensure it is a str.

Patch: https://github.com/aio-libs/aiohttp/pull/7835/files

Severity ?

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiohttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-27T23:17:42Z",
    "nvd_published_at": "2023-11-30T07:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nImproper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.\n\n### Details\nThe vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).\nFor example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter.\nFurthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.\n\nAt this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.\n\n### PoC\nThe POC below shows an example of providing an unvalidated array as a version:\nhttps://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e\n\n### Impact\nCRLF injection leading to Request Smuggling.\n\n### Workaround\nIf these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.\n\nPatch: https://github.com/aio-libs/aiohttp/pull/7835/files",
  "id": "GHSA-q3qx-c6g2-7pw2",
  "modified": "2025-11-03T22:32:00Z",
  "published": "2023-11-27T23:17:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49081"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/pull/7835/files"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aio-libs/aiohttp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-250.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aiohttp\u0027s ClientSession is vulnerable to CRLF injection via version"
}

CVE-2023-49081 (GCVE-0-2023-49081)

Vulnerability from cvelistv5 – Published: 2023-11-30 06:56 – Updated: 2025-11-04 18:19

Summary

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/pull/7835/files	x_refsource_MISC
	https://github.com/aio-libs/aiohttp/commit/1e86b7…	x_refsource_MISC
	https://gist.github.com/jnovikov/184afb593d9c2114…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:19:34.328Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"
          },
          {
            "name": "https://github.com/aio-libs/aiohttp/pull/7835/files",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/aio-libs/aiohttp/pull/7835/files"
          },
          {
            "name": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"
          },
          {
            "name": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-29T14:10:37.384Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/pull/7835/files",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/pull/7835/files"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"
        },
        {
          "name": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"
        }
      ],
      "source": {
        "advisory": "GHSA-q3qx-c6g2-7pw2",
        "discovery": "UNKNOWN"
      },
      "title": "aiohttp\u0027s ClientSession is vulnerable to CRLF injection via version"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-49081",
    "datePublished": "2023-11-30T06:56:26.348Z",
    "dateReserved": "2023-11-21T18:57:30.428Z",
    "dateUpdated": "2025-11-04T18:19:34.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2023-250

GHSA-Q3QX-C6G2-7PW2

Summary

Details

PoC

Impact

Workaround

CVE-2023-49081 (GCVE-0-2023-49081)

Tags

Sightings

Nomenclature