Bug 1223098 (CVE-2024-27306)

Summary:	VUL-0: CVE-2024-27306: python-aiohttp: XSS on index pages for static file handling
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	John Paul Adrian Glaubitz <adrian.glaubitz>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	adrian.glaubitz, camila.matos, kvanderveer, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/402616/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-27306:6.1:(AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-18 18:20:27 UTC

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27306
https://www.cve.org/CVERecord?id=CVE-2024-27306
https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397
https://github.com/aio-libs/aiohttp/pull/8319
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g

Comment 4 John Paul Adrian Glaubitz 2024-05-14 09:50:12 UTC

openSUSE:Factory already contains version 3.9.5, it was just missing the Bugzilla and CVE references which I have added now.

For SUSE:SLE-15-SP4:Update, I have backported the fix and submitted an updated package.

Fixing SUSE:SLE-15-SP1:Update is not trivial as the SP1 still ships 3.6.0 to which the fix requires more work to backport it.