Memory leak in aiohttp - CVE-2024-52303

Vulnerability identifier: #VU100601

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52303

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when a request produces a MatchInfoError. A remote attacker can force the application to leak memory and perform denial of service attack.

aiohttp
IBM Process Mining
Oracle Communications Cloud Native Core Network Data Analytics Function
Guardium Data Security Center (GDSC)
Oracle Communications Operations Monitor
IBM Cloud Pak for Watson AIOps
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component

Install updates from vendor's website.

aiohttp - update to 3.10.11
IBM Process Mining - update to 2.0
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Cloud Pak for Watson AIOps - update to 4.8.0
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8
• https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

• Multiple vulnerabilities in aiohttp
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for aio-libs aiohttp
• Memory leak in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Guardium Data Security Center