CVE-2021-21330

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

Impact

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware.

Patches

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows: pip install aiohttp >= 3.7.4

Workarounds

If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

References

• aiohttp @ PyPI
• GHSA-v6wp-4m6f-gcjg
• OWASP page on open redirects

For more information

If you have any questions or comments about this advisory:

• Open an issue in the aiohttp repo
• Email us at [email protected] and/or [email protected]

Credit: Jelmer Vernooij and Beast Glatisant.

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

Beast Glatisant and Jelmer Vernooij reported that python-aiohttp is prone to an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website (CVE-2021-21330).

These are all security issues fixed in the python310-aiohttp-3.8.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-aiohttp-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

This update for python-aiohttp, python-typing_extensions fixes the following issues:

• Include in SLE-15 (bsc#1197831)
• Fixed required/optional keys with old-style TypedDict
• Test in separate multibuild flavor to break depcycles with full python stdlib
• Clean requirements specifications for python flavors
• Add transitional typing-extensions provides
• Fix tests for Python 3.9
• Official support for Python 3.8 and 3.9
• Fix build without python2 available
• Fix isinstance() with generic protocol subclasses after subscripting
• Fix tests for non-default interpreters
• Use environment marker to specify typing dependency
• Fix unions of protocols on Python 2

This update for python-aiohttp fixes the following issues:

• CVE-2021-21330: Fixed the way pure-Python HTTP parser interprets // (bsc#1184745)

Jelmer Vernooij and Beast Glatisant discovered that AIOHTTP incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks.