Infinite loop in aiohttp - CVE-2024-30251

Vulnerability identifier: #VU89159

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30251

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker can send a specially crafted POST request, consume all available system resources and cause denial of service conditions.

aiohttp
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Desktop 15 SP4
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
Python 3 Module
openSUSE Leap
openEuler
Anolis OS
Oracle Communications Operations Monitor
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
libcomps (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python-iniparse (Red Hat package)
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-drf-spectacular (Red Hat package)
python-pulp-glue (Red Hat package)
m2crypto (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
python-asyncio-throttle (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
createrepo_c (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-rhsm (Red Hat package)
python-productmd (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-grpcio (Red Hat package)
rhui-cds-plugin-mirror (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
rhui-cds-plugin-authorizer (Red Hat package)
python-urlman (Red Hat package)
python-xlrd (Red Hat package)
python-charset-normalizer (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pygtrie (Red Hat package)
python-pyjwt (Red Hat package)
python-dateutil (Red Hat package)
ansible-core (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pycparser (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python-dynaconf (Red Hat package)
python-psycopg (Red Hat package)
python-psycopg_c (Red Hat package)
python-django-guid (Red Hat package)
python-tablib (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python-aiohttp-debugsource
python3-aiohttp
python-aiohttp-doc
python3-aiohttp-debuginfo
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp
python-aiohttp-help
python-aiohttp-debuginfo
python-aiohttp (Debian package)
python311-aiohttp
python311-aiohttp-debuginfo
dev-python/aiohttp
python-aiohttp (Red Hat package)
python3-aiohttp+speedups
python3x-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulp-rpm (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python-django (Red Hat package)
python-redis (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
python3x-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python-jsonschema (Red Hat package)
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-pyyaml (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
python-click (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-certifi (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
QRadar Suite
Red Hat Update Infrastructure (RHUI)

Install updates from vendor's website.

aiohttp - update to 3.9.4
libcomps (Red Hat package) - update to 0.1.21-1.el8ui
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-4.el8ui
python-iniparse (Red Hat package) - update to 0.4-40.0.1.el8ui
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - addressed in versions 0.5.0-1.el9ap, 0.5.0-1.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-5.el8ui
python-inflection (Red Hat package) - update to 0.5.1-7.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-7.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-5.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-6.el8ui
python-future (Red Hat package) - update to 0.18.3-5.el8ui
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
python-drf-spectacular (Red Hat package) - update to 0.26.5-5.el8ui
python-pulp-glue (Red Hat package) - update to 0.29.2-2.el8ui
m2crypto (Red Hat package) - update to 0.40.1-1.0.2.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-6.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-4.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-8.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-7.el8ui
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
python-brotli (Red Hat package) - update to 1.0.9-6.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-6.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-4.el8ui
createrepo_c (Red Hat package) - update to 1.1.3-1.0.1.el8ui
python-deprecated (Red Hat package) - update to 1.2.13-5.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-4.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-7.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-5.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-5.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-10.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-9.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-8.el8ui
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-6.el8ui
python-jq (Red Hat package) - update to 1.6.0-4.el8ui
python-yarl (Red Hat package) - update to 1.8.2-5.el8ui
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
QRadar Suite - update to 1.10.22.0
python-wrapt (Red Hat package) - update to 1.14.1-5.el8ui
python-markuppy (Red Hat package) - update to 1.14-7.el8ui
python-rhsm (Red Hat package) - update to 1.19.2-7.0.1.el8ui
python-productmd (Red Hat package) - update to 1.33-7.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-5.el8ui
python-grpcio (Red Hat package) - update to 1.65.4-1.el8ui
rhui-cds-plugin-mirror (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-fetcher (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer-cert (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer (Red Hat package) - update to 2.0.0-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-9.el8ui
python-charset-normalizer (Red Hat package) - update to 2.1.1-5.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-5.el8ui
python-backoff (Red Hat package) - update to 2.2.1-5.el8ui
python-urllib3 (Red Hat package) - update to 2.2.3-1.el8ui
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
python-pygtrie (Red Hat package) - update to 2.5.0-5.el8ui
python-pyjwt (Red Hat package) - update to 2.5.0-5.el8ui
python-dateutil (Red Hat package) - update to 2.8.2-7.el8ui
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap
python-pulp-container (Red Hat package) - update to 2.20.3-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.21.0-1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.21.1-1.el8ui
python-pycparser (Red Hat package) - update to 2.21-6.el8ui
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - addressed in versions 2.32.2-1.el9ap, 2.32.3-2.el8ui
python-aiodns (Red Hat package) - update to 3.0.0-7.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-4.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-5.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-4.el8ui
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - addressed in versions 3.1.4-1.el9ap, 3.1.4-1.el8ui
python-dynaconf (Red Hat package) - update to 3.1.12-4.el8ui
python-psycopg (Red Hat package) - update to 3.2.3-1.el8ui
python-psycopg_c (Red Hat package) - update to 3.2.3-1.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-5.el8ui
python-tablib (Red Hat package) - update to 3.3.0-5.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-5.el8ui
python-zipp (Red Hat package) - update to 3.4.0-8.el8ui
python-asgiref (Red Hat package) - update to 3.6.0-5.el8ui
python-aiohttp-debugsource - addressed in versions 3.6.0-150100.3.21.1, 3.9.3-150400.10.30.1
python3-aiohttp - update to 3.6.0-150100.3.21.1
python-aiohttp-doc - update to 3.6.0-150100.3.21.1
python3-aiohttp-debuginfo - update to 3.6.0-150100.3.21.1
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python3-aiohttp - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp-debugsource - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp-help - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp-debuginfo - addressed in versions 3.7.4-5, 3.7.4-6
python-aiohttp (Debian package) - update to 3.8.4-1+deb12u1
python311-aiohttp - update to 3.9.3-150400.10.30.1
python311-aiohttp-debuginfo - update to 3.9.3-150400.10.30.1
dev-python/aiohttp - update to 3.9.4
python-aiohttp (Red Hat package) - addressed in versions 3.9.4-1.el8ui, 3.9.5-1.el9ap
python3-aiohttp+speedups - update to 3.9.5-1
python3-aiohttp - update to 3.9.5-1
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
python-djangorestframework (Red Hat package) - update to 3.14.0-4.el8ui
python-pycryptodomex (Red Hat package) - update to 3.20.0-1.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.25.4-1.0.1.el8ui
python-pulp-rpm (Red Hat package) - update to 3.26.1-1.el8ui
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el9ap, 3.49.22-1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.49.19-1.0.2.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-6.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-6.el8ui
python-pycares (Red Hat package) - update to 4.1.2-6.el8ui
python-django (Red Hat package) - update to 4.2.15-1.el8ui
python-redis (Red Hat package) - update to 4.3.4-5.el8ui
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap
IBM Cloud Pak for Watson AIOps - update to 4.6.0
python-typing-extensions (Red Hat package) - update to 4.7.1-5.el8ui
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
python-jsonschema (Red Hat package) - update to 4.10.3-4.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.11.0
rhui-installer (Red Hat package) - update to 4.11.0.2-1.el8ui
rhui-tools (Red Hat package) - update to 4.11.0.4-1.el8ui
python-protobuf (Red Hat package) - update to 4.21.6-5.el8ui
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python-pyyaml (Red Hat package) - update to 5.4.1-8.0.1.el8ui
python-whitenoise (Red Hat package) - update to 6.0.0-5.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-5.el8ui
python-multidict (Red Hat package) - update to 6.0.4-5.el8ui
python-click (Red Hat package) - update to 8.1.3-5.el8ui
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
python-packaging (Red Hat package) - update to 21.3-6.el8ui
python-attrs (Red Hat package) - update to 21.4.0-6.el8ui
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el9ap, 22.0.0-1.0.1.el8ui
python-aiofiles (Red Hat package) - update to 22.1.0-5.el8ui
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
python-django-filter (Red Hat package) - update to 23.2-4.el8ui
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - addressed in versions 24.1.0-1.el9ap, 24.1.0-1.el8ui
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - addressed in versions 42.0.5-1.el9ap, 42.0.8-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-6.el8ui
python-certifi (Red Hat package) - update to 2022.12.7-5.0.1.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-5.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-7.el8ui

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84
• https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597
• https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19
• https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866
• http://www.openwall.com/lists/oss-security/2024/05/02/4

• Denial of service in aiohttp
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar Suite Software
• Gentoo update for aiohttp
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Debian update for python-aiohttp
• SUSE update for python-aiohttp
• SUSE update for python-aiohttp
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• openEuler 20.03 LTS SP4 update for python-aiohttp
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for aio-libs aiohttp
• openEuler 22.03 LTS SP4 update for python-aiohttp
• openEuler 22.03 LTS SP3 update for python-aiohttp
• Anolis OS update for python-aiohttp