CVE-2024-27306
Fixed in a distro release EPSS <1%CVSS 6.1
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Products: aio-libs aiohttp, aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.9.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | checkov | 3.0.34-r1 |
| Chainguard | dask-gateway | 2024.1.0-r4 |
| Chainguard | dask-gateway-server | 2024.1.0-r4 |
| Chainguard | kserve | 0.13.1-r3 |
| Chainguard | kserve-agent | 0.13.1-r3 |
| Chainguard | kserve-agent-compat | 0.13.1-r3 |
| Chainguard | kserve-manager | 0.13.1-r3 |
| Chainguard | kserve-manager-compat | 0.13.1-r3 |
| Chainguard | kserve-qpext | 0.13.1-r3 |
| Chainguard | kserve-qpext-compat | 0.13.1-r3 |
| Chainguard | kserve-router | 0.13.1-r3 |
| Chainguard | kserve-router-compat | 0.13.1-r3 |
| Chainguard | kserve-storage-controller | 0.13.1-r3 |
| Chainguard | nemo | 1.23.0-r12 |
| Chainguard | py3-cassandra-medusa | 0.20.1-r0 |
| Chainguard | py3-cassandra-medusa-compat | 0.20.1-r0 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r3 |
| Chainguard | request-1276 | 0.20.1-r0 |
| Chainguard | request-1276-compat | 0.20.1-r0 |
| Debian 11 | python-aiohttp | 3.7.4-1+deb11u1 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | 3.9.5-1 |
| Debian 14 | python-aiohttp | 3.9.5-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow-debugsource | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow-debuginfo | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow-debuginfo | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow-debugsource | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat rhui 4 | python-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python-aiohttp-debugsource | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python-cryptography | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python-cryptography-debugsource | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python-django | 0:4.2.15-1.el8ui |
| Red Hat rhui 4 | python-grpcio | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python-grpcio-debugsource | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat rhui 4 | python-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat rhui 4 | python-requests | 0:2.32.3-2.el8ui |
| Red Hat rhui 4 | python-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python3.11-django | 0:4.2.15-1.el8ui |
| Red Hat rhui 4 | python3.11-grpcio | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python3.11-grpcio-debuginfo | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python3.11-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat rhui 4 | python3.11-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat rhui 4 | python3.11-requests | 0:2.32.3-2.el8ui |
| Red Hat rhui 4 | python3.11-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat satellite 6.15 | python-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python-aiohttp-debugsource | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python-django | 0:4.2.14-1.el8pc |
| Red Hat satellite 6.15 | python-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite 6.15 | python-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python-pillow-debugsource | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.14-1.el8pc |
| Red Hat satellite 6.15 | python3.11-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pillow-debuginfo | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp-debugsource | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.14-1.el8pc |
| Red Hat satellite capsule 6.15 | python-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pillow-debugsource | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.14-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pillow-debuginfo | 0:10.3.0-1.el8pc |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | python-aiohttp | 3.6.0-150100.3.24.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | python-aiohttp | 3.6.0-150100.3.24.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.24.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.21.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.24.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.24.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-aiohttp | 3.9.3-150400.10.21.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-aiohttp | 3.9.3-150400.10.21.1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm5 |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm4 |
| Ubuntu Pro 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2+esm1 |
| Ubuntu Pro 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1+esm1 |
| Wolfi | checkov | 3.0.34-r1 |
| Wolfi | dask-gateway | 2024.1.0-r4 |
| Wolfi | dask-gateway-server | 2024.1.0-r4 |
| Wolfi | kserve | 0.13.1-r3 |
| Wolfi | kserve-agent | 0.13.1-r3 |
| Wolfi | kserve-agent-compat | 0.13.1-r3 |
| Wolfi | kserve-manager | 0.13.1-r3 |
| Wolfi | kserve-manager-compat | 0.13.1-r3 |
| Wolfi | kserve-qpext | 0.13.1-r3 |
| Wolfi | kserve-qpext-compat | 0.13.1-r3 |
| Wolfi | kserve-router | 0.13.1-r3 |
| Wolfi | kserve-router-compat | 0.13.1-r3 |
| Wolfi | kserve-storage-controller | 0.13.1-r3 |
| Wolfi | py3-cassandra-medusa | 0.20.1-r0 |
| Wolfi | py3-cassandra-medusa-compat | 0.20.1-r0 |
| openSUSE Leap 15.5 | python-aiohttp | 3.9.3-150400.10.21.1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.6.0-150100.3.24.1 |
| openSUSE Leap 15.6 | python-aiohttp | 3.9.3-150400.10.21.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.9.5-2.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 |