CVE-2023-47641

CVSS 3.1 Score 3.4 of 10 (low)

Details

Published Nov 14, 2023
Updated: Nov 22, 2023
CWE ID 444

Summary

CVE-2023-47641 is a security vulnerability affecting aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. The vulnerability arises from inconsistent interpretation of the http protocol, specifically when both Content-Length (CL) and Transfer-Encoding (TE) headers are present. This can lead to incorrect parsing of HTTP entities and the potential for socket poisoning. A possible exploit involves a configuration with a reverse proxy that accepts both CL and TE headers, tricking aiohttp into parsing an invalid TE header as CL. The impact of this vulnerability is significant as it allows bypassing of proxy rules and potential poisoning of sockets, enabling attacks such as passing Authentication Headers or exploiting Open Redirect vulnerabilities. It affects a wide range of products using aiohttp. To remediate the vulnerability, users are advised to update to the latest version of aiohttp that addresses this issue.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-47641 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options