CVE-2023-47641
CVSS 3.1 Score 3.4 of 10 (low)
Details
Summary
CVE-2023-47641 is a security vulnerability affecting aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. The vulnerability arises from inconsistent interpretation of the http protocol, specifically when both Content-Length (CL) and Transfer-Encoding (TE) headers are present. This can lead to incorrect parsing of HTTP entities and the potential for socket poisoning. A possible exploit involves a configuration with a reverse proxy that accepts both CL and TE headers, tricking aiohttp into parsing an invalid TE header as CL. The impact of this vulnerability is significant as it allows bypassing of proxy rules and potential poisoning of sockets, enabling attacks such as passing Authentication Headers or exploiting Open Redirect vulnerabilities. It affects a wide range of products using aiohttp. To remediate the vulnerability, users are advised to update to the latest version of aiohttp that addresses this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions