CVE-2024-23334
Publication date 29 January 2024
Last updated 5 September 2024
Ubuntu priority
Cvss 3 Severity Score
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Status
Package | Ubuntu Release | Status |
---|---|---|
python-aiohttp | 24.04 LTS noble |
Fixed 3.9.1-1ubuntu0.1
|
22.04 LTS jammy |
Fixed 3.8.1-4ubuntu0.2
|
|
20.04 LTS focal |
Fixed 3.6.2-1ubuntu1+esm3
|
|
18.04 LTS bionic |
Fixed 3.0.1-1ubuntu0.1~esm4
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6991-1
- AIOHTTP vulnerability
- 5 September 2024