Bug 1223098 (CVE-2024-27306) - VUL-0: CVE-2024-27306: python-aiohttp: XSS on index pages for static file handling
Summary: VUL-0: CVE-2024-27306: python-aiohttp: XSS on index pages for static file han...
Status: NEW
Alias: CVE-2024-27306
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: John Paul Adrian Glaubitz
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/402616/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-27306:6.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-18 18:20 UTC by SMASH SMASH
Modified: 2024-06-10 10:40 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-18 18:20:27 UTC
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27306
https://www.cve.org/CVERecord?id=CVE-2024-27306
https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397
https://github.com/aio-libs/aiohttp/pull/8319
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g
Comment 4 John Paul Adrian Glaubitz 2024-05-14 09:50:12 UTC
openSUSE:Factory already contains version 3.9.5, it was just missing the Bugzilla and CVE references which I have added now.

For SUSE:SLE-15-SP4:Update, I have backported the fix and submitted an updated package.

Fixing SUSE:SLE-15-SP1:Update is not trivial as the SP1 still ships 3.6.0 to which the fix requires more work to backport it.