CVE-2023-37276 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-37276 Interim 1 3 2023-10-13T23:09:14Z current 2023-07-20T23:14:55Z 2023-10-13T23:09:14Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-37276 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 python-aiohttp python-aiohttp-doc python3-aiohttp python311-aiohttp python-aiohttp-doc as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 python3-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 python-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 python-aiohttp-doc as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 python3-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 python-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 python3-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 python-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 python3-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 python-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 python3-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 python-aiohttp as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 python311-aiohttp as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python-aiohttp as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python311-aiohttp as a component of SUSE Linux Enterprise Module for Python 3 15 SP5 python-aiohttp as a component of SUSE Linux Enterprise Module for Python 3 15 SP5 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable. CVE-2023-37276 SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-aiohttp-doc SUSE Linux Enterprise Module for Public Cloud 15 SP1:python3-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP2:python-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP2:python-aiohttp-doc SUSE Linux Enterprise Module for Public Cloud 15 SP2:python3-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP3:python-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP3:python3-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP4:python-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP4:python3-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP5:python-aiohttp SUSE Linux Enterprise Module for Public Cloud 15 SP5:python3-aiohttp SUSE Linux Enterprise Module for Python 3 15 SP4:python-aiohttp SUSE Linux Enterprise Module for Python 3 15 SP4:python311-aiohttp SUSE Linux Enterprise Module for Python 3 15 SP5:python-aiohttp SUSE Linux Enterprise Module for Python 3 15 SP5:python311-aiohttp moderate 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N