Bugzilla – Bug 1223098
VUL-0: CVE-2024-27306: python-aiohttp: XSS on index pages for static file handling
Last modified: 2024-06-10 10:40:45 UTC
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27306 https://www.cve.org/CVERecord?id=CVE-2024-27306 https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 https://github.com/aio-libs/aiohttp/pull/8319 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g
openSUSE:Factory already contains version 3.9.5, it was just missing the Bugzilla and CVE references which I have added now. For SUSE:SLE-15-SP4:Update, I have backported the fix and submitted an updated package. Fixing SUSE:SLE-15-SP1:Update is not trivial as the SP1 still ships 3.6.0 to which the fix requires more work to backport it.