Security update for python-aiohttp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:1866-1 Final 1 1 2024-05-30T12:20:39Z current 2024-05-30T12:20:39Z 2024-05-30T12:20:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-aiohttp This update for python-aiohttp fixes the following issues: - CVE-2024-27306: Fixed XSS on index pages for static file handling (bsc#1223098) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP4-BYOS-Azure-2024-1866,Image SLES15-SP4-HPC-BYOS-2024-1866,Image SLES15-SP4-HPC-BYOS-Azure-2024-1866,Image SLES15-SP4-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP4-SAP-2024-1866,Image SLES15-SP4-SAP-Azure-2024-1866,Image SLES15-SP4-SAP-BYOS-Azure-2024-1866,Image SLES15-SP4-SAP-Hardened-2024-1866,Image SLES15-SP4-SAP-Hardened-Azure-2024-1866,Image SLES15-SP4-SAP-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP4-SAPCAL-2024-1866,Image SLES15-SP4-SAPCAL-Azure-2024-1866,Image SLES15-SP5-Azure-3P-2024-1866,Image SLES15-SP5-Azure-Basic-2024-1866,Image SLES15-SP5-Azure-Standard-2024-1866,Image SLES15-SP5-BYOS-Azure-2024-1866,Image SLES15-SP5-HPC-Azure-2024-1866,Image SLES15-SP5-HPC-BYOS-Azure-2024-1866,Image SLES15-SP5-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP5-SAP-Azure-3P-2024-1866,Image SLES15-SP5-SAP-BYOS-Azure-2024-1866,Image SLES15-SP5-SAP-Hardened-Azure-2024-1866,Image SLES15-SP5-SAP-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP5-SAPCAL-Azure-2024-1866,Image SLES15-SP6-Azure-Basic-2024-1866,Image SLES15-SP6-Azure-Standard-2024-1866,Image SLES15-SP6-BYOS-Azure-2024-1866,Image SLES15-SP6-HPC-2024-1866,Image SLES15-SP6-HPC-Azure-2024-1866,Image SLES15-SP6-HPC-BYOS-Azure-2024-1866,Image SLES15-SP6-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP6-SAP-Azure-2024-1866,Image SLES15-SP6-SAP-BYOS-Azure-2024-1866,Image SLES15-SP6-SAP-Hardened-2024-1866,Image SLES15-SP6-SAP-Hardened-Azure-2024-1866,Image SLES15-SP6-SAP-Hardened-BYOS-Azure-2024-1866,Image SLES15-SP6-SAPCAL-Azure-2024-1866,SUSE-2024-1866,SUSE-SLE-Module-Public-Cloud-15-SP4-2024-1866,SUSE-SLE-Module-Python3-15-SP5-2024-1866,SUSE-SLE-Module-Python3-15-SP6-2024-1866,openSUSE-SLE-15.5-2024-1866,openSUSE-SLE-15.6-2024-1866 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20241866-1/ Link for SUSE-SU-2024:1866-1 https://lists.suse.com/pipermail/sle-security-updates/2024-August/019253.html E-Mail link for SUSE-SU-2024:1866-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1223098 SUSE Bug 1223098 https://www.suse.com/security/cve/CVE-2024-27306/ SUSE CVE CVE-2024-27306 page Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Azure-3P Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAPCAL-Azure SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 python311-aiohttp-3.9.3-150400.10.21.1 python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-HPC-BYOS python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-HPC-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP-Hardened python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP-Hardened-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAPCAL python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP4-SAPCAL-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-Azure-3P python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-Azure-Basic python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-Azure-Standard python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-HPC-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-HPC-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-SAP-Azure-3P python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-SAP-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-SAP-Hardened-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP5-SAPCAL-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-Azure-Basic python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-Azure-Standard python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-HPC python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-HPC-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-HPC-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAP-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAP-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAP-Hardened python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAP-Hardened-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of Image SLES15-SP6-SAPCAL-Azure python311-aiohttp-3.9.3-150400.10.21.1 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 python311-aiohttp-3.9.3-150400.10.21.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP5 python311-aiohttp-3.9.3-150400.10.21.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 python311-aiohttp-3.9.3-150400.10.21.1 as a component of openSUSE Leap 15.5 python311-aiohttp-3.9.3-150400.10.21.1 as a component of openSUSE Leap 15.6 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. CVE-2024-27306 Image SLES15-SP4-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-HPC-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-HPC-BYOS:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP-Hardened-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP-Hardened:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAP:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAPCAL-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP4-SAPCAL:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-Azure-3P:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-Azure-Basic:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-Azure-Standard:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-HPC-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-HPC-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-SAP-Azure-3P:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-SAP-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-SAP-Hardened-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP5-SAPCAL-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-Azure-Basic:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-Azure-Standard:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-HPC-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-HPC-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-HPC:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAP-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAP-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAP-Hardened-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAP-Hardened-BYOS-Azure:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAP-Hardened:python311-aiohttp-3.9.3-150400.10.21.1 Image SLES15-SP6-SAPCAL-Azure:python311-aiohttp-3.9.3-150400.10.21.1 SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-aiohttp-3.9.3-150400.10.21.1 SUSE Linux Enterprise Module for Python 3 15 SP5:python311-aiohttp-3.9.3-150400.10.21.1 SUSE Linux Enterprise Module for Python 3 15 SP6:python311-aiohttp-3.9.3-150400.10.21.1 openSUSE Leap 15.5:python311-aiohttp-3.9.3-150400.10.21.1 openSUSE Leap 15.6:python311-aiohttp-3.9.3-150400.10.21.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241866-1/ https://www.suse.com/security/cve/CVE-2024-27306.html CVE-2024-27306 https://bugzilla.suse.com/1223098 SUSE Bug 1223098