CVE-2021-21330
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
How to fix
- aiohttp aiohttp3.7.4 or later
- aiohttp3.7.4 or later
- debian.org/security/2021/dsa-4864
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/
- security.gentoo.org/glsa/202208-19
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aiohttp aiohttp | v < 3.7.4 | 3.7.4 |
| debian debian_linux | 10.0 | — |
| fedoraproject fedora | 33, 34 | — |
| aiohttpPyPI | v < 3.7.4 | 3.7.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.