aiohttp: Open redirect vulnerability — GLSA 202208-19

An open redirect vulnerability has been discovered in aiohttp.

Affected packages

Background

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

Description

A bug in aiohttp.web_middlewares.normalize_path_middleware creates an open redirect vulnerability.

Impact

An attacker use this vulnerability to craft a link that, while appearing to be a link to an aiohttp-based website, redirects users to an arbitrary attacker-controlled URL.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-python/aiohttp-3.7.4"
 

References

• CVE-2021-21330
• GHSA-v6wp-4m6f-gcjg

Release date
August 10, 2022

Latest revision
August 10, 2022: 1

Severity
low

Exploitable
remote

Bugzilla entries

• 772932