CVE-2023-47641

一、漏洞信息
 漏洞编号：[CVE-2023-47641](https://nvd.nist.gov/vuln/detail/CVE-2023-47641)
 漏洞归属组件：[python-aiohttp](https://gitee.com/src-openeuler/python-aiohttp)
 漏洞归属的版本：3.7.4,3.8.3,3.8.4
 CVSS V3.0分值：
  BaseScore：3.4 Low
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
 漏洞简述：
  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect an attacker could combine it to redirect random users to another website and log the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to upgrade. There are no known workarounds for this vulnerability.
 漏洞公开时间：2023-11-15 05:15:13
 漏洞创建时间：2023-11-15 21:38:06
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-47641
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  |
| security-advisories.github.com | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47641 | https://bugzilla.suse.com/show_bug.cgi?id=1217174 |
| suse_bugzilla | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j | https://bugzilla.suse.com/show_bug.cgi?id=1217174 |
| redhat_bugzilla | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 | https://bugzilla.redhat.com/show_bug.cgi?id=2250179 |
| redhat_bugzilla | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j | https://bugzilla.redhat.com/show_bug.cgi?id=2250179 |
| github_advisory | https://github.com/aio-libs/aiohttp/releases/tag/v3.8.0 | https://github.com/advisories/GHSA-xx9p-xxvh-7g8j |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2023-47641 | https://github.com/advisories/GHSA-xx9p-xxvh-7g8j |
| github_advisory | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 | https://github.com/advisories/GHSA-xx9p-xxvh-7g8j |
| github_advisory | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j | https://github.com/advisories/GHSA-xx9p-xxvh-7g8j |
| python-aiohttp | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j |
| snyk | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 | https://security.snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6057352 |
| snyk | https://github.com/aio-libs/aiohttp/releases/tag/v3.8.0 | https://security.snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6057352 |
| security-advisories.github.com | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  |
| security-advisories.github.com | https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  | security-advisories.github.com |
|  |  | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  | redhat_bugzilla |
|  |  | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  | github_advisory |
|  |  | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  | python-aiohttp |
|  |  | https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371 |  | snyk |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      aiohttp 是用于 asyncio 和 Python 的异步 HTTP 客户端/服务器框架。受影响的 aiohttp 版本存在一个安全漏洞，涉及对 http 协议的不一致解释。HTTP/1.1 是一种持久协议，如果同时存在 Content-Length（CL） 和 Transfer-Encoding（TE） 标头值，则可能导致对解析 HTTP 的两个实体的错误解释，并且我们可以通过这种不正确的解释来毒害其他套接字。一个可能的概念验证 （POC） 是具有反向代理（前端）的配置，该代理接受 CL 和 TE 标头以及 aiohttp 作为后端。当 aiohttp 解析任何带有 chunked 的内容时，我们可以将 chunked123 作为 TE 传递，前端实体将忽略此标头并解析 Content-Length。此漏洞的影响是，可以绕过任何代理规则，将套接字毒害给其他用户，例如传递身份验证标头，如果存在开放重定向，攻击者可以将其组合在一起，将随机用户重定向到另一个网站并记录请求。此漏洞已在 aiohttp 3.8.0 版中得到解决。建议用户升级。此漏洞没有已知的变通办法。  
 openEuler评分：
  3.4
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(3.7.4):受影响
2.openEuler-20.03-LTS-SP3(3.7.4):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(3.7.4):受影响
5.openEuler-22.03-LTS-SP1(3.7.4):受影响
6.openEuler-22.03-LTS-SP2(3.7.4):受影响
7.openEuler-22.03-LTS-SP3:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(3.7.4):否
2.openEuler-20.03-LTS-SP3(3.7.4):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(3.7.4):否
5.openEuler-22.03-LTS-SP1(3.7.4):否
6.openEuler-22.03-LTS-SP2(3.7.4):否
7.openEuler-22.03-LTS-SP3:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1854

src-openEuler/python-aiohttp
关闭

内容风险标识

评论 (11)

src-openEuler/python-aiohttp关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-47641

评论 (11)

搜索帮助

src-openEuler/python-aiohttp
关闭