`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)

2021-02-2602:11:57

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.9%

JSON

Impact

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware.

Patches

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
pip install aiohttp >= 3.7.4

Workarounds

If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in the aiohttp repo
Email us at [email protected] and/or [email protected]

Credit: Jelmer Vernooĳ and Beast Glatisant.

CPENameOperatorVersion
aiohttpeq0.22.4
aiohttpeq0.16.6
aiohttpeq3.7.0b0
aiohttpeq1.1.0
aiohttpeq3.0.0b3
aiohttpeq3.0.0b1
aiohttpeq3.6.2a2
aiohttpeq0.22.0b0
aiohttpeq1.3.4
aiohttpeq0.6.4

Name	Operator	Version
aiohttp	eq	0.22.4
aiohttp	eq	0.16.6
aiohttp	eq	3.7.0b0
aiohttp	eq	1.1.0
aiohttp	eq	3.0.0b3
aiohttp	eq	3.0.0b1
aiohttp	eq	3.6.2a2
aiohttp	eq	0.22.0b0
aiohttp	eq	1.3.4
aiohttp	eq	0.6.4