OESA-2025-1047

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1047
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-1047.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-1047
Upstream
Published
2025-01-17T14:07:22Z
Modified
2025-08-12T05:46:41.160346Z
Summary
python-aiohttp security update
Details

Async http client/server framework (asyncio).

Security Fix(es):

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS / python-aiohttp

Package

Name
python-aiohttp
Purl
pkg:rpm/openEuler/python-aiohttp&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.3-6.oe2403

Ecosystem specific 

{
    "src": [
        "python-aiohttp-3.9.3-6.oe2403.src.rpm"
    ],
    "x86_64": [
        "python-aiohttp-debuginfo-3.9.3-6.oe2403.x86_64.rpm",
        "python-aiohttp-debugsource-3.9.3-6.oe2403.x86_64.rpm",
        "python-aiohttp-help-3.9.3-6.oe2403.x86_64.rpm",
        "python3-aiohttp-3.9.3-6.oe2403.x86_64.rpm"
    ],
    "aarch64": [
        "python-aiohttp-debuginfo-3.9.3-6.oe2403.aarch64.rpm",
        "python-aiohttp-debugsource-3.9.3-6.oe2403.aarch64.rpm",
        "python-aiohttp-help-3.9.3-6.oe2403.aarch64.rpm",
        "python3-aiohttp-3.9.3-6.oe2403.aarch64.rpm"
    ]
}