TI-2024-15436 CVE-2024-23334 · GHSA-5h86-8mv2-jq9f
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
RHSA-2024:1536
Satellite 6.14.3 Async Security Update
Released 2024-03-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Satellite 6.14 for RHEL 8 python-aiohttp-3.9.2-0.1.el8pc, python-django-3.2.22-1.el8pc, python-galaxy-importer-0.4.18-2.el8pc +5
Fixes 7 records
TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg
Request smuggling in aiohttp
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2
aiohttp's ClientSession is vulnerable to CRLF injection via version
Priority HIGH 65
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-15823 CVE-2024-23829 · GHSA-8qpw-xqxj-h4r2
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Priority LOW 37
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-23390 CVE-2023-43665 · GHSA-h8gc-pgj2-vjm3
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the…
Priority LOW 36
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c…
TI-2023-04777 CVE-2023-5189 · GHSA-55g2-vm3q-7w52
Hub: insecure galaxy-importer tarfile extraction
Priority LOW 31
A path traversal vulnerability exists in Ansible when extracting tarballs.
TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95
Jinja vulnerable to Cross-Site Scripting (XSS)
Priority LOW 29
Jinja is an extensible templating engine.