CVE-2024-42367
2 advisories.
PyPI/aiohttp CVE-2024-42367: medium 4.8
In aiohttp, compressed files as symlinks are not protected from path traversal
Action: Upgrade aiohttp to 3.10.2 or later.
pip install aiohttp==3.10.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.10.0b1 | 3.10.2 | - |
Fixed versions
| 3.10.2 |
Sources
- osv: GHSA-jwhx-xcg6-8xhj
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj
- https://nvd.nist.gov/vuln/detail/CVE-2024-42367
- https://github.com/aio-libs/aiohttp/pull/8653
- https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f
- https://github.com/aio-libs/aiohttp
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674
CVE-2024-42367 · published · modified · JSON
PyPI/aiohttp CVE-2024-42367: medium 4.8
In aiohttp, compressed files as symlinks are not protected from path traversal
Action: Upgrade aiohttp to 3.10.2 or later.
pip install aiohttp==3.10.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.10.0b1 | 3.10.2 | - |
Fixed versions
| 3.10.2 |
Sources
- osv: PYSEC-2026-1108
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj
- https://nvd.nist.gov/vuln/detail/CVE-2024-42367
- https://github.com/aio-libs/aiohttp/pull/8653
- https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f
- https://github.com/aio-libs/aiohttp
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674
- https://pypi.org/project/aiohttp
- https://github.com/advisories/GHSA-jwhx-xcg6-8xhj
CVE-2024-42367 · published · modified · JSON