CVE-2024-23334
Fixed in a distro release EPSS 77%CVSS 5.9
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.9.2 |
| PyPI | aiohttp | 1c335944d6a8b1298baf179b7c0b3069f10c514b |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | checkov | 3.0.34-r1 |
| Chainguard | py3-aiohttp | 3.9.3-r0 |
| Chainguard | py3-cassandra-medusa | 0.17.2-r1 |
| Chainguard | py3-cassandra-medusa-compat | 0.17.2-r1 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r1 |
| Debian 11 | python-aiohttp | 3.7.4-1+deb11u1 |
| Debian 12 | python-aiohttp | 3.8.4-1+deb12u1 |
| Debian 13 | python-aiohttp | 3.9.5-1 |
| Debian 14 | python-aiohttp | 3.9.5-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.5-2.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.5-2.el8ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-django | 0:4.2.11-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-django | 0:4.2.11-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-django | 0:4.2.11-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-django | 0:4.2.11-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.5-1.el9ap |
| Red Hat rhui 4 | python-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python-aiohttp-debugsource | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python-cryptography | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python-cryptography-debugsource | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python-django | 0:4.2.11-1.el8ui |
| Red Hat rhui 4 | python-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat rhui 4 | python-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography-debuginfo | 0:41.0.6-1.el8ui |
| Red Hat rhui 4 | python3.11-django | 0:4.2.11-1.el8ui |
| Red Hat rhui 4 | python3.11-ecdsa | 0:0.18.0-4.el8ui |
| Red Hat rhui 4 | python3.11-jinja2 | 0:3.1.3-1.el8ui |
| Red Hat satellite 6.14 | python-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python-aiohttp-debugsource | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python-django | 0:3.2.22-1.el8pc |
| Red Hat satellite 6.14 | python-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite 6.14 | python-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite 6.14 | python39-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python39-aiohttp-debuginfo | 0:3.9.2-0.1.el8pc |
| Red Hat satellite 6.14 | python39-django | 0:3.2.22-1.el8pc |
| Red Hat satellite 6.14 | python39-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite 6.14 | python39-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-cli | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-debug | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-dynflow-sidekiq | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-ec2 | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-journald | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-libvirt | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-openstack | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-ovirt | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-pcp | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-postgresql | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-redis | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-service | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-telemetry | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | foreman-vmware | 0:3.9.1.6-1.el8sat |
| Red Hat satellite 6.15 | puppetserver | 0:7.14.0-1.el8sat |
| Red Hat satellite 6.15 | python-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python-aiohttp-debugsource | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python-django | 0:4.2.9-1.el8pc |
| Red Hat satellite 6.15 | python-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite 6.15 | python-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite 6.15 | python-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python-pycryptodomex-debugsource | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.9-1.el8pc |
| Red Hat satellite 6.15 | python3.11-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite 6.15 | python3.11-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pycryptodomex-debuginfo | 0:3.20.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite 6.15 | rubygem-activesupport | 0:6.1.7.6-1.el8sat |
| Red Hat satellite 6.15 | rubygem-audited | 0:5.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma | 0:6.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma-debuginfo | 0:6.4.2-1.el8sat |
| Red Hat satellite 6.15 | rubygem-puma-debugsource | 0:6.4.2-1.el8sat |
| Red Hat satellite capsule 6.14 | python-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python-aiohttp-debugsource | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python-django | 0:3.2.22-1.el8pc |
| Red Hat satellite capsule 6.14 | python-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite capsule 6.14 | python-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-aiohttp | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-aiohttp-debuginfo | 0:3.9.2-0.1.el8pc |
| Red Hat satellite capsule 6.14 | python39-django | 0:3.2.22-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-galaxy-importer | 0:0.4.18-2.el8pc |
| Red Hat satellite capsule 6.14 | python39-jinja2 | 0:3.1.3-0.1.el8pc |
| Red Hat satellite capsule 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-debug | 0:3.9.1.6-1.el8sat |
| Red Hat satellite capsule 6.15 | puppetserver | 0:7.14.0-1.el8sat |
| Red Hat satellite capsule 6.15 | python-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp-debugsource | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.9-1.el8pc |
| Red Hat satellite capsule 6.15 | python-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite capsule 6.15 | python-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pycryptodomex-debugsource | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.2-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.9-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-galaxy-importer | 0:0.4.19-2.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-jinja2 | 0:3.1.3-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pycryptodomex | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pycryptodomex-debuginfo | 0:3.20.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pygments | 0:2.17.0-1.el8pc |
| Red Hat satellite capsule 6.15 | rubygem-activesupport | 0:6.1.7.6-1.el8sat |
| Red Hat satellite utils 6.15 | foreman | 0:3.9.1.6-1.el8sat |
| Red Hat satellite utils 6.15 | foreman-cli | 0:3.9.1.6-1.el8sat |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-aiohttp | 3.9.3-150400.10.14.1 |
| Ubuntu 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2 |
| Ubuntu 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1 |
| Ubuntu 25.10 | python-aiohttp | no fix |
| Ubuntu 26.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm4 |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm3 |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | checkov | 3.0.34-r1 |
| Wolfi | py3-aiohttp | 3.9.3-r0 |
| Wolfi | py3-cassandra-medusa | 0.17.2-r1 |
| Wolfi | py3-cassandra-medusa-compat | 0.17.2-r1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.9.3-150400.10.14.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.9.3-1.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 |