GitStock

aio-libs/aiohttp · Security

`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)

GHSA ID
GHSA-v6wp-4m6f-gcjg
CVE ID
CVE-2021-21330
Severity
low
Published
Updated
CVSS
3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v3
3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Impact

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware.

Patches

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows: pip install aiohttp >= 3.7.4

Workarounds

If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.

References

For more information

If you have any questions or comments about this advisory:

Credit: Jelmer Vernooij and Beast Glatisant.

CWEs

  • CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')

References