Test ID:	1.3.6.1.4.1.25623.1.0.114552
Category:	Web Servers
Title:	aiohttp < 3.8.5 HTTP Request Smuggling Vulnerability - Linux
Summary:	aiohttp is prone to a HTTP request smuggling vulnerability.
Description:	Summary: aiohttp is prone to a HTTP request smuggling vulnerability. Vulnerability Insight: aiohttp.web.Application is vulnerable to HTTP request smuggling via llhttp HTTP request parser. aiohttp is bundled with llhttp which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. Affected Software/OS: aiohttp versions prior to 3.8.5. Solution: Update to version 3.8.5 or later. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-30589 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/ https://hackerone.com/reports/2001873 Common Vulnerability Exposure (CVE) ID: CVE-2023-37276 https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.