CVE-2024-27306
EUVD-2024-114318.04.2024, 15:15
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| aiohttp | aiohttp | 𝑥 < 3.9.4 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| aiohttp | aiohttp | 𝑥 < 3.9.4 | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| python-aiohttp-doc |
| ||||||||
| python3-aiohttp |
| ||||||||
| python311-aiohttp |
|
References