CVE-2024-42367

NameCVE-2024-42367
Descriptionaiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-aiohttp (PTS)stretch1.2.0-1vulnerable
buster (security), buster, buster (lts)3.5.1-1+deb10u1vulnerable
bullseye3.7.4-1vulnerable
bookworm3.8.4-1vulnerable
sid, trixie3.10.10-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-aiohttpsourcestretch(unfixed)end-of-life
python-aiohttpsourcebuster(unfixed)end-of-life
python-aiohttpsource(unstable)3.10.3-2

Notes

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj
https://github.com/aio-libs/aiohttp/pull/8653
https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f (v3.10.2)

Search for package or bug name: Reporting problems