Multiple vulnerabilities have been discovered in aiohttp, the worst of which could lead to service compromise.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-python/aiohttp | * | < 3.9.4 | >= 3.9.4 |
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
Multiple vulnerabilities have been discovered in aiohttp. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All aiohttp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/aiohttp-3.9.4"
An open redirect vulnerability has been discovered in aiohttp.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-python/aiohttp | * | < 3.7.4 | >= 3.7.4 |
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
A bug in aiohttp.web_middlewares.normalize_path_middleware creates an open redirect vulnerability.
An attacker use this vulnerability to craft a link that, while appearing to be a link to an aiohttp-based website, redirects users to an arbitrary attacker-controlled URL.
There is no known workaround at this time.
All aiohttp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/aiohttp-3.7.4"