CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp

2024-05-0213:55:06

CWE-835

GitHub_M

github.com

denial of service

malformed post requests

aiohttp

asyncio

python

security patch

version 3.9.4

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:aio-libs_project:aiohttp:-:*:*:*:*:*:*:*"
    ],
    "vendor": "aio-libs_project",
    "product": "aiohttp",
    "versions": [
      {
        "status": "affected",
        "version": "-",
        "lessThan": "3.9.4",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]