UBUNTU-CVE-2024-23334

See a problem?

Source

https://ubuntu.com/security/CVE-2024-23334

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-23334.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-23334

Related

Published

2024-01-29T23:15:00Z

Modified

2024-10-15T14:12:52Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'followsymlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

References

Affected packages

Ubuntu:Pro:16.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.17.2-1

0.17.4-1

0.17.4-1build1

0.20.2-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.1-1ubuntu0.1~esm4

Affected versions

2.*

2.2.3-1build1

2.2.3-2

2.3.6-1

3.*

3.0.1-1

3.0.1-1ubuntu0.1~esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.0.1-1ubuntu0.1~esm4",
            "binary_name": "python3-aiohttp"
        },
        {
            "binary_version": "3.0.1-1ubuntu0.1~esm4",
            "binary_name": "python3-aiohttp-dbg"
        }
    ]
}

Ubuntu:20.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.5.4-1

3.5.4-1build1

3.6.1-1

3.6.2-1

3.6.2-1build1

3.6.2-1ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.2-1ubuntu1+esm3

Affected versions

3.*

3.5.4-1

3.5.4-1build1

3.6.1-1

3.6.2-1

3.6.2-1build1

3.6.2-1ubuntu0.1~esm1

3.6.2-1ubuntu1

3.6.2-1ubuntu1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.6.2-1ubuntu1+esm3",
            "binary_name": "python3-aiohttp"
        },
        {
            "binary_version": "3.6.2-1ubuntu1+esm3",
            "binary_name": "python3-aiohttp-dbg"
        }
    ]
}

Ubuntu:22.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.1-4ubuntu0.2

Affected versions

3.*

3.7.4-1

3.7.4-1build2

3.8.1-3

3.8.1-4

3.8.1-4build1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.8.1-4ubuntu0.2",
            "binary_name": "python-aiohttp-doc"
        },
        {
            "binary_version": "3.8.1-4ubuntu0.2",
            "binary_name": "python3-aiohttp"
        },
        {
            "binary_version": "3.8.1-4ubuntu0.2",
            "binary_name": "python3-aiohttp-dbgsym"
        }
    ]
}

Ubuntu:24.10 / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.9.1-1build1

3.9.5-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:deb/ubuntu/python-aiohttp?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.9.1-1ubuntu0.1

Affected versions

3.*

3.8.4-1

3.9.1-1

3.9.1-1build1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.9.1-1ubuntu0.1",
            "binary_name": "python-aiohttp-doc"
        },
        {
            "binary_version": "3.9.1-1ubuntu0.1",
            "binary_name": "python3-aiohttp"
        },
        {
            "binary_version": "3.9.1-1ubuntu0.1",
            "binary_name": "python3-aiohttp-dbgsym"
        }
    ]
}