Lucene search
UbuntuUSN-6991-1HistorySep 05, 2024 - 12:00 a.m.
AIOHTTP vulnerability
2024-09-0500:00:00
ubuntu.com
6
ubuntu
aiohttp
vulnerability
file access
follow_symlinks
remote attacker
unauthorized files
python-aiohttp
asyncio
unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.9
Confidence
Low
EPSS
0.115
Percentile
95.4%
Releases
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 ESM
Packages
- python-aiohttp - http client/server for asyncio
Details
It was discovered that AIOHTTP did not properly restrict file access when
the ‘follow_symlinks’ option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 24.04 | noarch | python-aiohttp-doc | < 3.9.1-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 24.04 | noarch | python3-aiohttp | < 3.9.1-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 24.04 | noarch | python3-aiohttp-dbgsym | < 3.9.1-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 22.04 | noarch | python-aiohttp-doc | < 3.8.1-4ubuntu0.2 | UNKNOWN |
| Ubuntu | 22.04 | noarch | python3-aiohttp | < 3.8.1-4ubuntu0.2 | UNKNOWN |
| Ubuntu | 22.04 | noarch | python3-aiohttp-dbgsym | < 3.8.1-4ubuntu0.2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | python3-aiohttp | < 3.6.2-1ubuntu1+esm3 | UNKNOWN |
| Ubuntu | 20.04 | noarch | python3-aiohttp | < 3.6.2-1ubuntu1 | UNKNOWN |
| Ubuntu | 20.04 | noarch | python3-aiohttp-dbg | < 3.6.2-1ubuntu1 | UNKNOWN |
| Ubuntu | 18.04 | noarch | python3-aiohttp | < 3.0.1-1ubuntu0.1~esm4 | UNKNOWN |
References
Related
f5
f5
K000139353 : aiohttp vulnerability CVE-2024-23334
2024-04-19 00:00:00
githubexploit
githubexploit
Exploit for Path Traversal in Aiohttp
2024-09-08 10:37:29
Exploit for Path Traversal in Aiohttp
2024-06-17 16:28:35
Exploit for Path Traversal in Aiohttp
2024-03-17 10:56:02
osv
osv
aiohttp is vulnerable to directory traversal
2024-01-29 22:31:03
python310-aiohttp-3.9.3-1.1 on GA media
2024-06-15 00:00:00
CVE-2024-23334
2024-01-29 23:15:08
veracode
veracode
Path Traversal
2024-01-30 07:29:34
ubuntucve
ubuntucve
CVE-2024-23334
2024-01-29 00:00:00
nvd
nvd
CVE-2024-23334
2024-01-29 23:15:08
github
github
aiohttp is vulnerable to directory traversal
2024-01-29 22:31:03
wolfi
wolfi
CVE-2024-23334 vulnerabilities
2024-09-29 09:21:20
prion
prion
Directory traversal
2024-01-29 23:15:00
attackerkb
attackerkb
CVE-2024-23334
2024-01-29 00:00:00
debiancve
debiancve
CVE-2024-23334
2024-01-29 23:15:08
nessus
nessus
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : AIOHTTP vulnerability (USN-6991-1)
2024-09-05 00:00:00
Fedora 39 : python-aiohttp (2024-f249b74f03)
2024-02-05 00:00:00
Fedora 38 : python-aiohttp (2024-0ddda4c691)
2024-02-08 00:00:00
cgr
cgr
CVE-2024-23334 vulnerabilities
2024-05-19 03:07:16
openvas
openvas
Ubuntu: Security Advisory (USN-6991-1)
2024-09-06 00:00:00
Fedora: Security Advisory (FEDORA-2024-f249b74f03)
2024-02-05 00:00:00
Fedora: Security Advisory for python-aiohttp (FEDORA-2024-0ddda4c691)
2024-02-10 00:00:00
alpinelinux
alpinelinux
CVE-2024-23334
2024-01-29 23:15:08
redhatcve
redhatcve
CVE-2024-23334
2024-01-30 09:21:32
cvelist
cvelist
nuclei
nuclei
aiohttp - Directory Traversal
2024-02-28 04:56:41
cve
cve
CVE-2024-23334
2024-01-29 23:15:08
fedora
fedora
[SECURITY] Fedora 39 Update: python-aiohttp-3.9.3-1.fc39
2024-02-05 01:27:09
[SECURITY] Fedora 38 Update: python-aiohttp-3.9.3-1.fc38
2024-02-09 01:52:27
redos
redos
ROS-20240423-07
2024-04-23 00:00:00
hivepro
hivepro
Attacks, Vulnerabilities and Actors 18 to 24 March 2024
2024-03-27 05:12:55
ibm
ibm
redhat
redhat
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.9
Confidence
Low
EPSS
0.115
Percentile
95.4%
Related for USN-6991-1