[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4a05754d4e8f49b8f1ce5dcacb91c2c44a8e1252.camel@sambull.org>
Date: Thu, 02 May 2024 14:48:19 +0100
From: Sam Bull <9m199i@...bull.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-30251: DoS in aiohttp
Aiohttp is an HTTP client and server-side web framework in Python. This issue only affects
users of the server-side web framework. We've not seen any evidence of this being
exploited in the wild yet, and fixes were already included in the 3.9.4 and 3.9.5
releases.
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84
### Summary
An attacker can send a specially crafted POST (multipart/form-data) request. When the
aiohttp server processes it, the server will enter an infinite loop and be unable to
process any further requests.
### Impact
An attacker can stop the application from serving requests after sending a single request.
-------
For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve
the issue is (located in `_read_chunk_from_length()`):
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index 227be605c..71fc2654a 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -338,6 +338,8 @@ class BodyPartReader:
assert self._length is not None, "Content-Length required for chunked read"
chunk_size = min(size, self._length - self._read_bytes)
chunk = await self._content.read(chunk_size)
+ if self._content.at_eof():
+ self._at_eof = True
return chunk
async def _read_chunk_from_stream(self, size: int) -> bytes:
This does however introduce some very minor issues with handling form data. So, if
possible, it would be recommended to also backport the changes in:
https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19
https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597
https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866
Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
