REDHAT-BUG-2484099: High severity aiohttp aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.0 - Compensating control
On aiohttp releases prior to 3.14.0, use a workaround by sanitizing files/data before calling CookieJar.load() with untrusted input to avoid arbitrary code execution.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484099?
The severity of REDHAT-BUG-2484099 is classified as high with a score of 7.
What is the risk associated with REDHAT-BUG-2484099?
REDHAT-BUG-2484099 has a risk rating of 33, indicating a significant potential impact.
How do I fix REDHAT-BUG-2484099?
To fix REDHAT-BUG-2484099, you should upgrade aiohttp to version 3.14.0 or later.
What kind of vulnerability is reported in REDHAT-BUG-2484099?
REDHAT-BUG-2484099 describes a vulnerability that may allow arbitrary code execution when using CookieJar.load() with untrusted input.
Who is affected by the vulnerability identified in REDHAT-BUG-2484099?
Most applications using CookieJar.load() with user-provided data could potentially be affected by the vulnerability in REDHAT-BUG-2484099.