Critical HTTP Request Smuggling Vulnerability in python-aiohttp
Summary
DEBIAN-CVE-2023-37276: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects python-aiohttp versions < 3.8.5-1. Fixed in 3.8.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-aiohttp is an asynchronous HTTP client/server framework designed for asyncio and Python. It enables developers to build web applications and services that can handle multiple requests concurrently. The package is widely used for its efficiency and ease of integration with Python's asynchronous programming model. However, versions 3.8.4 and earlier are bundled with a vulnerable HTTP request parser, which can lead to serious security issues when used as an HTTP server.
Vulnerability Detail
The vulnerability in python-aiohttp arises from its use of llhttp v6.0.6 for HTTP request parsing. This issue specifically affects users operating aiohttp as an HTTP server (via aiohttp.Application). When a crafted HTTP request is sent, the server may misinterpret certain HTTP header values, leading to HTTP request smuggling. This can allow attackers to manipulate requests and responses, potentially compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
3.8.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-aiohttpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can disable the vulnerable llhttp HTTP request parser by reinstalling aiohttp with the following command: 'AIOHTTP_NO_EXTENSIONS=1 pip install aiohttp'. This will revert to the pure Python implementation, which is not vulnerable.
Conclusion
The vulnerability in python-aiohttp poses a significant risk for applications using it as an HTTP server. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. Workarounds are available for those unable to upgrade immediately, but these should only be temporary solutions.
See every vulnerability recorded for python-aiohttp →
FAQ
The vulnerability allows for HTTP request smuggling due to improper parsing of HTTP headers in aiohttp versions 3.8.4 and earlier.
Only users running aiohttp as an HTTP server are affected. Those using it solely as an HTTP client are not impacted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can set the environment variable 'AIOHTTP_NO_EXTENSIONS=1' to disable the vulnerable parser until you can upgrade.
Yes, the permanent fix is to upgrade to version 3.8.5-1 or later of python-aiohttp, which addresses the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-aiohttp.
