search

ManageIQ / manageiq-rpm_build

Code to build RPMs for ManageIQ appliances and container images
Apache License 2.0
10 stars 25 forks source link

CVE-2023-49081 (High) detected in aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl - autoclosed #501

Closed mend-bolt-for-github[bot] closed 2 months ago

mend-bolt-for-github[bot] commented 2 months ago

CVE-2023-49081 - High Severity Vulnerability

Vulnerable Library - aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Async http client/server framework (asyncio)

Library home page: https://files.pythonhosted.org/packages/a5/e7/af237a28203958d885f7f57731cb4f9c510597a35c593c5c20224dd72072/aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Path to dependency file: /config/requirements.txt

Path to vulnerable library: /config/requirements.txt

Dependency Hierarchy: - :x: **aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl** (Vulnerable Library)

Found in HEAD commit: 8cc957a8dd8d2068335a64c65361156e3e2f72f8

Found in base branch: master

Vulnerability Details

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Publish Date: 2023-11-30

URL: CVE-2023-49081

CVSS 3 Score Details (7.2)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2

Release Date: 2023-11-30

Fix Resolution: 3.9.0

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 2 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.