CVE-2023-47627
Fixed in a distro release EPSS <1%CVSS 5.3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.8.6 |
| PyPI | aiohttp | d5c12ba890557a575c313bb3017910d7616fce3d |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | py3-cassandra-medusa | 0.19.1-r1 |
| Chainguard | py3-cassandra-medusa-compat | 0.19.1-r1 |
| Debian 11 | python-aiohttp | 3.7.4-1+deb11u1 |
| Debian 12 | python-aiohttp | 3.8.4-1+deb12u1 |
| Debian 13 | python-aiohttp | 3.8.6-1 |
| Debian 14 | python-aiohttp | 3.8.6-1 |
| Red Hat ansible automation platform 2.4 | ansible-automation-platform-installer | 0:2.4-6.el8ap |
| Red Hat ansible automation platform 2.4 | ansible-automation-platform-installer | 0:2.4-6.el9ap |
| Red Hat ansible automation platform 2.4 | ansible-rulebook | 0:1.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | ansible-rulebook | 0:1.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.5-2.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.5-2.el9ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller | 0:1.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller | 0:1.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller-server | 0:1.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller-server | 0:1.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller-ui | 0:1.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-eda-controller-ui | 0:1.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-django | 0:4.2.11-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-django | 0:4.2.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow | 0:10.0.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow-debugsource | 0:10.0.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pycryptodomex | 0:3.20.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pycryptodomex-debugsource | 0:3.20.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-django | 0:4.2.11-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-django | 0:4.2.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow | 0:10.0.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow-debuginfo | 0:10.0.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pycryptodomex | 0:3.20.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pycryptodomex-debuginfo | 0:3.20.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-django | 0:4.2.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-django | 0:4.2.11-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow | 0:10.0.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow-debuginfo | 0:10.0.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pycryptodomex | 0:3.20.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pycryptodomex-debuginfo | 0:3.20.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-django | 0:4.2.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-django | 0:4.2.11-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow | 0:10.0.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow-debugsource | 0:10.0.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pycryptodomex | 0:3.20.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pycryptodomex-debugsource | 0:3.20.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python39-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-jinja2 | 0:3.1.3-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-pygments | 0:2.17.2-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python39-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-jinja2 | 0:3.1.3-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-pygments | 0:2.17.2-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat rhui 4 | python-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python-aiohttp-debugsource | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python-cryptography | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python-cryptography-debugsource | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python-django | 0:4.2.11-1.el8ui |
| Red Hat rhui 4 | python-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat rhui 4 | python-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography-debuginfo | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python3.11-django | 0:4.2.11-1.el8ui |
| Red Hat rhui 4 | python3.11-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat rhui 4 | python3.11-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat satellite 6.14 | python-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python-aiohttp-debugsource | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python-django | 0:3.2.22-1.el8pc |
| Red Hat satellite 6.14 | python-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite 6.14 | python-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite 6.14 | python39-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python39-aiohttp-debuginfo | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python39-django | 0:3.2.22-1.el8pc |
| Red Hat satellite 6.14 | python39-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite 6.14 | python39-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-cli | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-debug | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-dynflow-sidekiq | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-ec2 | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-journald | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-libvirt | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-openstack | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-ovirt | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-pcp | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-postgresql | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-redis | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-service | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-telemetry | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-vmware | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | puppetserver | 0:7.14.0-1.el8sat |
| Red Hat satellite 6.15 | python-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python-aiohttp-debugsource | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python-django | 0:4.2.9-1.el8pc |
| Red Hat satellite 6.15 | python-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite 6.15 | python-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite 6.15 | python-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python-pycryptodomex-debugsource | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.9-1.el8pc |
| Red Hat satellite 6.15 | python3.11-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite 6.15 | python3.11-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pycryptodomex-debuginfo | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite 6.15 | rubygem-activesupport | 0:6.1.7.6-1.el8sat |
| Red Hat satellite 6.15 | rubygem-audited | 0:5.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma | 0:6.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma-debuginfo | 0:6.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma-debugsource | 0:6.4.2-1.el8sat |
| Red Hat satellite capsule 6.14 | python-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python-aiohttp-debugsource | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python-django | 0:3.2.22-1.el8pc |
| Red Hat satellite capsule 6.14 | python-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite capsule 6.14 | python-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-aiohttp-debuginfo | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-django | 0:3.2.22-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite capsule 6.14 | python39-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite capsule 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-debug | 0:3.9.1.6-1.el8sat |
| Red Hat satellite capsule 6.15 | puppetserver | 0:7.14.0-1.el8sat |
| Red Hat satellite capsule 6.15 | python-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp-debugsource | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.9-1.el8pc |
| Red Hat satellite capsule 6.15 | python-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite capsule 6.15 | python-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pycryptodomex-debugsource | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.9-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pycryptodomex-debuginfo | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite capsule 6.15 | rubygem-activesupport | 0:6.1.7.6-1.el8sat |
| Red Hat satellite utils 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite utils 6.15 | foreman-cli | 0:3.9.1.6-1.el8sat |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-aiohttp | 3.9.3-150400.10.14.1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm5 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm4 |
| Ubuntu Pro 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2+esm1 |
| Ubuntu Pro 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1+esm1 |
| Wolfi | py3-cassandra-medusa | 0.19.1-r1 |
| Wolfi | py3-cassandra-medusa-compat | 0.19.1-r1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.9.3-150400.10.14.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.9.0-1.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 |