Headline
Ubuntu Security Notice USN-6991-1
Ubuntu Security Notice 6991-1 - It was discovered that AIOHTTP did not properly restrict file access when the ‘follow_symlinks’ option was set to True. A remote attacker could possibly use this issue to access unauthorized files on the system.
==========================================================================
Ubuntu Security Notice USN-6991-1
September 05, 2024
python-aiohttp vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
python-aiohttp would allow unintended access to files over the network.
Software Description:
- python-aiohttp: http client/server for asyncio
Details:
It was discovered that AIOHTTP did not properly restrict file access when
the ‘follow_symlinks’ option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
python-aiohttp-doc 3.9.1-1ubuntu0.1
python3-aiohttp 3.9.1-1ubuntu0.1
Ubuntu 22.04 LTS
python-aiohttp-doc 3.8.1-4ubuntu0.2
python3-aiohttp 3.8.1-4ubuntu0.2
Ubuntu 20.04 LTS
python3-aiohttp 3.6.2-1ubuntu1+esm3
Available with Ubuntu Pro
Ubuntu 18.04 LTS
python3-aiohttp 3.0.1-1ubuntu0.1~esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6991-1
CVE-2024-23334
Package Information:
https://launchpad.net/ubuntu/+source/python-aiohttp/3.9.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-aiohttp/3.8.1-4ubuntu0.2
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEETB/nIDy9nvCSgAUj3gXQmO/Tr3wFAmbaO5QACgkQ3gXQmO/T
r3w3hg/+Jd3vvi9UVfPnbSXnVWX6GJLLTHFdcXFH4RcQiPlFQM2iGRrQjNa5qXzK
hor5PKU+At52cq2YGGHbqUA0Zx0+iE/XGcqP/V3ke/cmGM8MAz0MdrKht8et6TcZ
yliGm2MLTg0zXGne90VjTxQ95WgDcftLiqpeRxiAMx5LCVXfW/YkmuA+AW+1GTVh
gu4eczV9S+HpF/MBRPGDe5Jb1VilW30ygiV9aeJWMRJfLUovnJeGY8RfCjUsF+rC
zBU5iDrY6/Fgdq6zp2uks/h5HOncs0OzT38F8L0fgiSWmDfxtBRXfg98Wd/xoo9/
BJizQWZpLn50AGmQ8+NwD7rMYGlgFtVhm5TOo4DPotOWiwpmpq41Z1Q8J+cK/Kmz
ZLNVO5s5yusyPkkDC07iIthPkG10O3vh7FM0bvNztxWUKf+K7MkG/kxm3TyHSF1a
p8oS15JLAlQzwElIf4JaQkeHedOOv4apfDyTDw44t+/gaP4PTJkHPvwlSGPwTcQn
6dg+i8udFDBoD8csZeFl7jLaJ7CuUnvhs1RIqjpKnMFL30kYWqXFtRPSEx/ObG8Q
H31sNb5U1KUDMqz7PivEJ/q4uHQLlGYNCyKpsHnzDg92zLgkshL5/r1pJYY9+PKL
Y5lFbZEeyMKvbeLGuhQwjjG0M4VhRYENQSJxxqWVCMLsJUdF/T0=
=sQ45
-----END PGP SIGNATURE-----
Related news
Red Hat Security Advisory 2024-2010-03 - An update is now available for Red Hat Satellite 6.15. The release contains a new version of Satellite and important security fixes for various components. Issues addressed include HTTP request smuggling, crlf injection, denial of service, file disclosure, and traversal vulnerabilities.
Red Hat Security Advisory 2024-1878-03 - An updated version of Red Hat Update Infrastructure is now available. RHUI 4.8 fixes several security an operational bugs, adds some new features and upgrades the underlying Pulp to a newer version. Issues addressed include HTTP request smuggling, crlf injection, denial of service, and traversal vulnerabilities.
Red Hat Security Advisory 2024-1640-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, denial of service, local file inclusion, memory leak, and traversal vulnerabilities.
### Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. ### Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. i.e. An application is only vulnerable with setup code like: ``` app.router.add_routes([ web.static("/static", "static/", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability ]) ``` ### Impact This is a directory traversal vulnerability with CWE I...