CVE-2023-47627

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

How to fix CVE-2023-47627

To remediate CVE-2023-47627, upgrade the affected package to a fixed version below.

• —upgrade to 3.7.4-1+deb11u1 or later
• —upgrade to 3.7.4-1+deb11u1 or later
• —upgrade to 3.8.4-1+deb12u1 or later
• —upgrade to 3.8.6 or later
• —upgrade to d5c12ba890557a575c313bb3017910d7616fce3d or later

Is CVE-2023-47627 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 3.7.4-1+deb11u1
• from 0, < 3.7.4-1+deb11u1
• from 0, < 3.8.4-1+deb12u1
• from 0, < 3.8.6
• from 0, < d5c12ba890557a575c313bb3017910d7616fce3d | from 0, < 3.8.6

CVSS scores

References (11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-47627
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-47627
• PATCHgithub.com/aio-libs/aiohttp
• WEBgithub.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d