DEBIAN-CVE-2023-49081

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2023-49081
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-49081.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-49081
Upstream
Published
2023-11-30T07:15:08Z
Modified
2025-09-25T23:28:53.535357Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

References

Affected packages

Debian:11 / python-aiohttp

Package

Name
python-aiohttp
Purl
pkg:deb/debian/python-aiohttp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.7.4-1+deb11u1

Affected versions

3.*

3.7.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / python-aiohttp

Package

Name
python-aiohttp
Purl
pkg:deb/debian/python-aiohttp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.4-1+deb12u1

Affected versions

3.*

3.8.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / python-aiohttp

Package

Name
python-aiohttp
Purl
pkg:deb/debian/python-aiohttp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / python-aiohttp

Package

Name
python-aiohttp
Purl
pkg:deb/debian/python-aiohttp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}