[USN-6991-1] AIOHTTP vulnerability
[USN-6991-1] AIOHTTP vulnerability
==========================================================================
Ubuntu Security Notice USN-6991-1
September 05, 2024
python-aiohttp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
python-aiohttp would allow unintended access to files over the network.
Software Description:
- python-aiohttp: http client/server for asyncio
Details:
It was discovered that AIOHTTP did not properly restrict file access when
the 'follow_symlinks' option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
python-aiohttp-doc 3.9.1-1ubuntu0.1
python3-aiohttp 3.9.1-1ubuntu0.1
Ubuntu 22.04 LTS
python-aiohttp-doc 3.8.1-4ubuntu0.2
python3-aiohttp 3.8.1-4ubuntu0.2
Ubuntu 20.04 LTS
python3-aiohttp 3.6.2-1ubuntu1+esm3
Available with Ubuntu Pro
Ubuntu 18.04 LTS
python3-aiohttp 3.0.1-1ubuntu0.1~esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6991-1
CVE-2024-23334
Package Information:
https://launchpad.net/ubuntu/+source/python-aiohttp/3.9.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-aiohttp/3.8.1-4ubuntu0.2
