python310-aiohttp-3.10.5-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14280-1 Final 1 1 2024-08-20T00:00:00Z current 2024-08-20T00:00:00Z 2024-08-20T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python310-aiohttp-3.10.5-1.1 on GA media These are all security issues fixed in the python310-aiohttp-3.10.5-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14280 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-42367/ SUSE CVE CVE-2024-42367 page openSUSE Tumbleweed python310-aiohttp-3.10.5-1.1 python311-aiohttp-3.10.5-1.1 python312-aiohttp-3.10.5-1.1 python310-aiohttp-3.10.5-1.1 as a component of openSUSE Tumbleweed python311-aiohttp-3.10.5-1.1 as a component of openSUSE Tumbleweed python312-aiohttp-3.10.5-1.1 as a component of openSUSE Tumbleweed aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue. CVE-2024-42367 openSUSE Tumbleweed:python310-aiohttp-3.10.5-1.1 openSUSE Tumbleweed:python311-aiohttp-3.10.5-1.1 openSUSE Tumbleweed:python312-aiohttp-3.10.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-42367.html CVE-2024-42367 https://bugzilla.suse.com/1229226 SUSE Bug 1229226