CVE-2023-47627

描述

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

如何修補 CVE-2023-47627

要修補 CVE-2023-47627,請將受影響套件升級到下列已修補版本。

• —升級至 3.7.4-1+deb11u1 或更新版本
• —升級至 3.7.4-1+deb11u1 或更新版本
• —升級至 3.8.4-1+deb12u1 或更新版本
• —升級至 3.8.6 或更新版本
• —升級至 d5c12ba890557a575c313bb3017910d7616fce3d 或更新版本

CVE-2023-47627 正在被利用嗎?

低 — EPSS 為 0.9%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0, < 3.7.4-1+deb11u1
• from 0, < 3.7.4-1+deb11u1
• from 0, < 3.8.4-1+deb12u1
• from 0, < 3.8.6
• from 0, < d5c12ba890557a575c313bb3017910d7616fce3d | from 0, < 3.8.6

CVSS 分數

參考連結(11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-47627
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-47627
• PATCHgithub.com/aio-libs/aiohttp
• WEBgithub.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d
• WEB