python3.12-aiohttp vulnerabilities (Red Hat)
71 vulnerabilities.
-
python3.12-aiohttpRed Hat GitPython before 3.1.59 Arbitrary File Read via TagReference.create 7.1 High -
python3.12-aiohttpRed Hat GitPython before 3.1.59 Path Traversal via separate-git-dir 8.7 High -
python3.12-aiohttpRed Hat Awx: notification backends allow ssrf and credential leakage 7.7 High -
python3.12-aiohttpRed Hat Awx: project archive extraction allows path traversal file writes 7.2 High -
python3.12-aiohttpRed Hat Awx: webhook status callback ssrf leaks the git pat 7.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.58 Command Execution via split_single_char_options 8.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.58 Config Injection via option-name 8.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name 8.4 High -
python3.12-aiohttpRed Hat GitPython before 3.1.58 Remote Code Execution via Repo.init 7.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.58 Arbitrary File Overwrite via read-tree 7.2 High -
python3.12-aiohttpRed Hat Server-side file-write and request forgery via spatial lookups 8.7 High -
python3.12-aiohttpRed Hat AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) 7.1 High -
python3.12-aiohttpRed Hat GitPython before 3.1.57 Arbitrary File Overwrite and Read 7.2 High -
python3.12-aiohttpRed Hat Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header 8.2 High -
python3.12-aiohttpRed Hat Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn 7.5 High -
python3.12-aiohttpRed Hat GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() 8.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling 8.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.54 Remote Code Execution via --template 7.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.54 Arbitrary File Overwrite via diff 7.2 High -
python3.12-aiohttpRed Hat GitPython before 3.1.52 Environment Variable Exfiltration via clone_from 8.7 High -
python3.12-aiohttpRed Hat jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) 8.7 High -
python3.12-aiohttpRed Hat GitPython before 3.1.51 Command Injection via unguarded Git options 8.6 High -
python3.12-aiohttpRed Hat GitPython before 3.1.51 Command Injection via option prefix abbreviation 8.7 High -
python3.12-aiohttpRed Hat GitPython 3.1.50 Authentication Bypass via Joined Short Options 9.3 Critical -
python3.12-aiohttpRed Hat Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332) 7.8 High -
python3.12-aiohttpRed Hat pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service 7.5 High -
python3.12-aiohttpRed Hat pyasn1: Uncontrolled resource consumption when converting decoded REAL values 7.5 High -
python3.12-aiohttpRed Hat Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` 8.2 High -
python3.12-aiohttpRed Hat Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections 6.9 Medium -
python3.12-aiohttpRed Hat Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading 7.5 High -
python3.12-aiohttpRed Hat Pillow GdImageFile decompression bomb protection bypass 7.5 High -
python3.12-aiohttpRed Hat Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` 7.5 High -
python3.12-aiohttpRed Hat Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading 7.5 High -
python3.12-aiohttpRed Hat jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation 8.1 High -
python3.12-aiohttpRed Hat form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 8.7 High -
python3.12-aiohttpRed Hat Awxkit: path traversal via yaml !include directive 4.7 Medium -
python3.12-aiohttpRed Hat Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution 7.8 High -
python3.12-aiohttpRed Hat quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion 5.3 Medium -
python3.12-aiohttpRed Hat Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service 5.3 Medium -
python3.12-aiohttpRed Hat Quadratic complexity in WordDecoder.DecodeHeader in mime 7.5 High -
python3.12-aiohttpRed Hat Inefficient candidate hostname parsing in crypto/x509 6.5 Medium -
python3.12-aiohttpRed Hat AIOHTTP Vulnerable to Deserialization of Untrusted Data 6.4 Medium -
python3.12-aiohttpRed Hat PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 7.4 High -
python3.12-aiohttpRed Hat tmp: Path Traversal via unsanitized prefix/postfix enables directory escape 7.7 High -
python3.12-aiohttpRed Hat `jwt` (Ruby gem) - empty-key HMAC bypass 9.1 Critical -
python3.12-aiohttpRed Hat Quadratic string concatenation in consumePhrase in net/mail 7.5 High -
python3.12-aiohttpRed Hat Quadratic string concatentation in consumeComment in net/mail 7.5 High -
python3.12-aiohttpRed Hat Crash when handling long CNAME response in net 7.5 High -
python3.12-aiohttpRed Hat GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath 7.8 High -
python3.12-aiohttpRed Hat GitPython: Command injection via Git options bypass 8.8 High - Show olderLoading…