TI-2024-15436 CVE-2024-23334 · GHSA-5h86-8mv2-jq9f
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
RHSA-2024:1878
RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements
Released 2024-04-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHUI 4 for RHEL 8 python-aiohttp-3.9.2-1.el8ui, python-cryptography-41.0.6-1.el8ui, python-django-4.2.11-1.el8ui +7
Fixes 14 records
TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg
Request smuggling in aiohttp
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-18906 CVE-2023-37276 · GHSA-45c4-8wx5-qw6w
aiohttp vulnerable to HTTP request smuggling
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-15443 CVE-2024-23342 · GHSA-wj6h-64fc-37mp
python-ecdsa vulnerable to Minerva attack on P-256
Priority HIGH 68
The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECD…
TI-2023-26748 CVE-2023-49083 · GHSA-jfhm-5ghh-2f97
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Priority HIGH 66
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2
aiohttp's ClientSession is vulnerable to CRLF injection via version
Priority HIGH 65
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-26747 CVE-2023-49082 · GHSA-qvrw-v9rv-5rjx
aiohttp's ClientSession is vulnerable to CRLF injection via method
Priority MEDIUM 63
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-18103 CVE-2023-36053 · GHSA-jh3w-4vvf-mjgr
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and…
Priority MEDIUM 44
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name la…
TI-2024-16215 CVE-2024-24680 · GHSA-xxj9-f6rv-m3x4
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0…
Priority MEDIUM 42
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.
TI-2024-15823 CVE-2024-23829 · GHSA-8qpw-xqxj-h4r2
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Priority LOW 37
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-23390 CVE-2023-43665 · GHSA-h8gc-pgj2-vjm3
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the…
Priority LOW 36
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c…
TI-2023-21773 CVE-2023-41164 · GHSA-7h4p-27mh-hmrw
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5…
Priority LOW 36
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode cha…
TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95
Jinja vulnerable to Cross-Site Scripting (XSS)
Priority LOW 29
Jinja is an extensible templating engine.
TI-2024-18189 CVE-2024-27351 · GHSA-vm8q-m57g-pff3
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the…
Priority LOW 28
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expressi…