Cross-site scripting in aiohttp - CVE-2024-27306

Vulnerability identifier: #VU88804

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-27306

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the web.static(..., show_index=True) method in index pages for static file handling. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

aiohttp
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Fedora
Public Cloud Module
openSUSE Leap
openEuler
Anolis OS
libcomps (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python-iniparse (Red Hat package)
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python-openapi-core
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-drf-spectacular (Red Hat package)
python-pulp-glue (Red Hat package)
m2crypto (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
python-asyncio-throttle (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
createrepo_c (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-rhsm (Red Hat package)
python-productmd (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-grpcio (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-authorizer (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
rhui-cds-plugin-mirror (Red Hat package)
python-urlman (Red Hat package)
python-xlrd (Red Hat package)
python-charset-normalizer (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pygtrie (Red Hat package)
python-pyjwt (Red Hat package)
python-dateutil (Red Hat package)
ansible-core (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pycparser (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python-dynaconf (Red Hat package)
python-psycopg_c (Red Hat package)
python-psycopg (Red Hat package)
python-tablib (Red Hat package)
python-django-guid (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python-aiohttp-doc
python3-aiohttp
python-aiohttp-debugsource
python3-aiohttp-debuginfo
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp-help
python-aiohttp-debuginfo
python-aiohttp
python-aiohttp (Red Hat package)
python3-aiohttp+speedups
python3x-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulp-rpm (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python-django (Red Hat package)
python-redis (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
automation-hub (Red Hat package)
python3x-galaxy-ng (Red Hat package)
python-galaxy-ng (Red Hat package)
python-jsonschema (Red Hat package)
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-pyyaml (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
python-click (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-certifi (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
QRadar Suite
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Red Hat Update Infrastructure (RHUI)

Install updates from vendor's website.

aiohttp - update to 3.9.4
libcomps (Red Hat package) - update to 0.1.21-1.el8ui
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-4.el8ui
python-iniparse (Red Hat package) - update to 0.4-40.0.1.el8ui
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - addressed in versions 0.5.0-1.el9ap, 0.5.0-1.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-5.el8ui
python-inflection (Red Hat package) - update to 0.5.1-7.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-7.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-5.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-6.el8ui
python-future (Red Hat package) - update to 0.18.3-5.el8ui
python-openapi-core - update to 0.19.1-3.fc40
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
python-drf-spectacular (Red Hat package) - update to 0.26.5-5.el8ui
python-pulp-glue (Red Hat package) - update to 0.29.2-2.el8ui
m2crypto (Red Hat package) - update to 0.40.1-1.0.2.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-6.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-4.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-8.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-7.el8ui
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
python-brotli (Red Hat package) - update to 1.0.9-6.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-6.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-4.el8ui
createrepo_c (Red Hat package) - update to 1.1.3-1.0.1.el8ui
python-deprecated (Red Hat package) - update to 1.2.13-5.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-4.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-7.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-5.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-5.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-10.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-9.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-8.el8ui
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-6.el8ui
python-jq (Red Hat package) - update to 1.6.0-4.el8ui
python-yarl (Red Hat package) - update to 1.8.2-5.el8ui
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
QRadar Suite - update to 1.10.22.0
python-wrapt (Red Hat package) - update to 1.14.1-5.el8ui
python-markuppy (Red Hat package) - update to 1.14-7.el8ui
python-rhsm (Red Hat package) - update to 1.19.2-7.0.1.el8ui
python-productmd (Red Hat package) - update to 1.33-7.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-5.el8ui
python-grpcio (Red Hat package) - update to 1.65.4-1.el8ui
rhui-cds-plugin-fetcher (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer-cert (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-mirror (Red Hat package) - update to 2.0.0-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-9.el8ui
python-charset-normalizer (Red Hat package) - update to 2.1.1-5.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-5.el8ui
python-backoff (Red Hat package) - update to 2.2.1-5.el8ui
python-urllib3 (Red Hat package) - update to 2.2.3-1.el8ui
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
python-pygtrie (Red Hat package) - update to 2.5.0-5.el8ui
python-pyjwt (Red Hat package) - update to 2.5.0-5.el8ui
python-dateutil (Red Hat package) - update to 2.8.2-7.el8ui
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap
python-pulp-container (Red Hat package) - update to 2.20.3-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.21.0-1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.21.1-1.el8ui
python-pycparser (Red Hat package) - update to 2.21-6.el8ui
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - addressed in versions 2.32.2-1.el9ap, 2.32.3-2.el8ui
python-aiodns (Red Hat package) - update to 3.0.0-7.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-4.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-5.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-4.el8ui
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - addressed in versions 3.1.4-1.el9ap, 3.1.4-1.el8ui
python-dynaconf (Red Hat package) - update to 3.1.12-4.el8ui
python-psycopg_c (Red Hat package) - update to 3.2.3-1.el8ui
python-psycopg (Red Hat package) - update to 3.2.3-1.el8ui
python-tablib (Red Hat package) - update to 3.3.0-5.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-5.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-5.el8ui
python-zipp (Red Hat package) - update to 3.4.0-8.el8ui
python-asgiref (Red Hat package) - update to 3.6.0-5.el8ui
python-aiohttp-doc - update to 3.6.0-150100.3.24.1
python3-aiohttp - update to 3.6.0-150100.3.24.1
python-aiohttp-debugsource - update to 3.6.0-150100.3.24.1
python3-aiohttp-debuginfo - update to 3.6.0-150100.3.24.1
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python-aiohttp-help - addressed in versions 3.7.4-5, 3.7.4-6
python3-aiohttp - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp-debugsource - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp-debuginfo - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp (Red Hat package) - addressed in versions 3.9.4-1.el8ui, 3.9.5-1.el9ap
python3-aiohttp+speedups - update to 3.9.5-1
python3-aiohttp - update to 3.9.5-1
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
python-aiohttp - addressed in versions 3.9.5-1.el9, 3.9.5-1.fc38, 3.9.5-1.fc39, 3.9.5-1.fc40
python-djangorestframework (Red Hat package) - update to 3.14.0-4.el8ui
python-pycryptodomex (Red Hat package) - update to 3.20.0-1.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.25.4-1.0.1.el8ui
python-pulp-rpm (Red Hat package) - update to 3.26.1-1.el8ui
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el9ap, 3.49.22-1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.49.19-1.0.2.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-6.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-6.el8ui
python-pycares (Red Hat package) - update to 4.1.2-6.el8ui
python-django (Red Hat package) - update to 4.2.15-1.el8ui
python-redis (Red Hat package) - update to 4.3.4-5.el8ui
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap
IBM Cloud Pak for Watson AIOps - update to 4.6.0
python-typing-extensions (Red Hat package) - update to 4.7.1-5.el8ui
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
python-jsonschema (Red Hat package) - update to 4.10.3-4.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.11.0
rhui-installer (Red Hat package) - update to 4.11.0.2-1.el8ui
rhui-tools (Red Hat package) - update to 4.11.0.4-1.el8ui
python-protobuf (Red Hat package) - update to 4.21.6-5.el8ui
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python-pyyaml (Red Hat package) - update to 5.4.1-8.0.1.el8ui
python-whitenoise (Red Hat package) - update to 6.0.0-5.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-5.el8ui
python-multidict (Red Hat package) - update to 6.0.4-5.el8ui
python-click (Red Hat package) - update to 8.1.3-5.el8ui
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
python-packaging (Red Hat package) - update to 21.3-6.el8ui
python-attrs (Red Hat package) - update to 21.4.0-6.el8ui
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el9ap, 22.0.0-1.0.1.el8ui
python-aiofiles (Red Hat package) - update to 22.1.0-5.el8ui
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
python-django-filter (Red Hat package) - update to 23.2-4.el8ui
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - addressed in versions 24.1.0-1.el9ap, 24.1.0-1.el8ui
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - addressed in versions 42.0.5-1.el9ap, 42.0.8-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-6.el8ui
python-certifi (Red Hat package) - update to 2022.12.7-5.0.1.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-5.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-7.el8ui

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g

• Cross-site scripting in aiohttp
• Fedora 40 update for python-aiohttp, python-openapi-core
• Fedora 39 update for python-aiohttp
• Fedora 38 update for python-aiohttp
• Fedora EPEL 9 update for python-aiohttp
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar Suite Software
• SUSE update for python-aiohttp
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• openEuler 20.03 LTS SP4 update for python-aiohttp
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for aio-libs aiohttp
• openEuler 22.03 LTS SP4 update for python-aiohttp
• openEuler 22.03 LTS SP3 update for python-aiohttp
• Anolis OS update for python-aiohttp