CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version

2023-11-3006:56:26

CWE-20

GitHub_M

www.cve.org

aiohttp

clientsession

vulnerability

http request

patch

asyncio

python

crlf injection

version control

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.8%

JSON

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

CNA Affected

[
  {
    "vendor": "aio-libs",
    "product": "aiohttp",
    "versions": [
      {
        "version": "< 3.9.0",
        "status": "affected"
      }
    ]
  }
]