GitStock

aio-libs/aiohttp-session · Security

aiohttp-session creates non-expiring sessions

GHSA ID
GHSA-mr4x-c4v9-x729
CVE ID
CVE-2018-1000814
Severity
high
Published
Updated
CVSS
6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v3
6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

CWEs

  • CWE-613 · Insufficient Session Expiration

References