Bugzilla – Bug 1184745
VUL-0: CVE-2021-21330: python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
Last modified: 2023-09-06 20:55:08 UTC
CVE-2021-21330 A flaw was found in python-aiohttp. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware. References: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg References: https://bugzilla.redhat.com/show_bug.cgi?id=1933364 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21330 http://www.debian.org/security/-1/dsa-4864 https://www.debian.org/security/2021/dsa-4864 https://access.redhat.com/security/cve/CVE-2021-21330 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21330 https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25 https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/ https://pypi.org/project/aiohttp/
Tracked as affected SLE15-Sp1 and Leap 15.2 Factory is already in version 3.7.4
SUSE-SU-2021:1313-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1184745 CVE References: CVE-2021-21330 JIRA References: Sources used: SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src): python-aiohttp-3.4.4-3.6.1 SUSE Linux Enterprise Module for Public Cloud 15-SP2 (src): python-aiohttp-3.4.4-3.6.1 SUSE Linux Enterprise Module for Public Cloud 15-SP1 (src): python-aiohttp-3.4.4-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This has been fixed.
This is an autogenerated message for OBS integration: This bug (1184745) was mentioned in https://build.opensuse.org/request/show/1109336 Factory / python-aiohttp