CVE-2021-21330
Fixed in a distro release EPSS 2%CVSS 3.1
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.7.4 |
| PyPI | aiohttp | 2545222a3853e31ace15d87ae0e2effb7da0c96b |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | python-aiohttp | 3.7.4-1 |
| Debian 10 | python-aiohttp | 3.5.1-1+deb10u1 |
| Debian 12 | python-aiohttp | 3.7.4-1 |
| Debian 13 | python-aiohttp | 3.7.4-1 |
| Debian 14 | python-aiohttp | 3.7.4-1 |
| Red Hat satellite 6.10 | candlepin | 0:4.0.9-1.el7sat |
| Red Hat satellite 6.10 | foreman | 0:2.5.2.17-2.el7sat |
| Red Hat satellite 6.10 | python-aiohttp | 0:3.7.4-1.el7pc |
| Red Hat satellite 6.10 | python-ecdsa | 0:0.13.3-2.el7pc |
| Red Hat satellite 6.10 | python-pyyaml | 0:5.4.1-1.el7pc |
| Red Hat satellite 6.10 | python-urllib3 | 0:1.26.5-1.el7pc |
| Red Hat satellite 6.10 | python3-django | 0:2.2.24-1.el7pc |
| Red Hat satellite 6.10 | python3-ecdsa | 0:0.13.3-2.el7pc |
| Red Hat satellite 6.10 | python3-pyyaml | 0:5.4.1-1.el7pc |
| Red Hat satellite 6.10 | python3-urllib3 | 0:1.26.5-1.el7pc |
| Red Hat satellite 6.10 | satellite | 0:6.10.0-3.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-actionpack | 0:6.0.3.7-1.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-activerecord-session_store | 0:2.0.0-1.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-addressable | 0:2.8.0-1.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-nokogiri | 0:1.11.3-2.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-puma | 0:5.3.2-1.el7sat |
| Red Hat satellite 6.10 | tfm-rubygem-rails | 0:6.0.3.7-1.el7sat |
| Red Hat satellite capsule 6.10 | foreman | 0:2.5.2.17-2.el7sat |
| Red Hat satellite capsule 6.10 | python-aiohttp | 0:3.7.4-1.el7pc |
| Red Hat satellite capsule 6.10 | python-ecdsa | 0:0.13.3-2.el7pc |
| Red Hat satellite capsule 6.10 | python-pyyaml | 0:5.4.1-1.el7pc |
| Red Hat satellite capsule 6.10 | python-urllib3 | 0:1.26.5-1.el7pc |
| Red Hat satellite capsule 6.10 | python3-django | 0:2.2.24-1.el7pc |
| Red Hat satellite capsule 6.10 | python3-ecdsa | 0:0.13.3-2.el7pc |
| Red Hat satellite capsule 6.10 | python3-pyyaml | 0:5.4.1-1.el7pc |
| Red Hat satellite capsule 6.10 | python3-urllib3 | 0:1.26.5-1.el7pc |
| Red Hat satellite capsule 6.10 | satellite | 0:6.10.0-3.el7sat |
| Red Hat satellite capsule 6.10 | satellite-capsule | 0:6.10.0-3.el7sat |
| Red Hat satellite capsule 6.10 | tfm-rubygem-nokogiri | 0:1.11.3-2.el7sat |
| SUSE Linux Enterprise Module for Public Cloud 15 SP1 | python-aiohttp | 3.4.4-3.6.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP1 | python-aiohttp | 3.6.0-150100.3.9.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP1 | python-typing_extensions | 3.10.0.0-150100.3.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | python-aiohttp | 3.4.4-3.6.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | python-aiohttp | 3.6.0-150100.3.9.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | python-typing_extensions | 3.10.0.0-150100.3.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | python-aiohttp | 3.6.0-150100.3.9.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | python-typing_extensions | 3.10.0.0-150100.3.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.9.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | python-typing_extensions | 3.10.0.0-150400.3.2.1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu0.1~esm1 |
| openSUSE Leap 15.3 | python-aiohttp | 3.6.0-150100.3.9.1 |
| openSUSE Leap 15.4 | python-aiohttp | 3.6.0-150100.3.9.1 |
| openSUSE Leap 15.4 | python-typing_extensions | 3.10.0.0-150400.3.2.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.8.5-2.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 |