Skip to main content

Improper Input Validation

CVE-2023-49081

Medium
5.3/10

Summary

The package aiohttp's ClientSession is vulnerable to CRLF injection via version. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version. This affects versions through 3.9.0b1, 4.0.0a0, and 4.0.0a1.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published