{"action":"Upgrade aiohttp to 3.7.4 or later.","affected":[{"fixed":"3.7.4","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2021-21330"],"ecosystem":"PyPI","epss":0.01905,"exploited":false,"fixed_versions":["3.7.4"],"ghsa_id":"GHSA-v6wp-4m6f-gcjg","id":"tcs_01M5KGF2B0T9AKMMDFVSFTTS3B","modified_at":"2023-11-08T04:04:41.517445Z","published_at":"2021-02-26T03:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-76","https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b","https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25","https://pypi.org/project/aiohttp/","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg","https://www.debian.org/security/2021/dsa-4864","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-76","url":"https://osv.dev/vulnerability/PYSEC-2021-76"}],"summary":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based"}