mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-27 12:01:38 +01:00
0cffa14fcf
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
Security-sensitive parts of the Python HTTP parser retained minor differences in
allowable character sets, that must trigger error handling to robustly match frame
boundaries of proxies in order to protect against injection of additional requests.
Additionally, validation could trigger exceptions that were not handled consistently
with processing of other malformed input. Being more lenient than internet standards
require could, depending on deployment environment, assist in request smuggling. The
unhandled exception could cause excessive resource consumption on the application
server and/or its logging facilities. This vulnerability exists due to an incomplete
fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-23829
https://security-tracker.debian.org/tracker/CVE-2024-23829
Upstream patch:
d33bc21414
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
38 lines
1.2 KiB
BlitzBasic
38 lines
1.2 KiB
BlitzBasic
SUMMARY = "Async http client/server framework"
|
|
DESCRIPTION = "Asynchronous HTTP client/server framework for asyncio and Python"
|
|
HOMEPAGE = "https://github.com/aio-libs/aiohttp"
|
|
LICENSE = "Apache-2.0"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=748073912af33aa59430d3702aa32d41"
|
|
|
|
SRC_URI += "file://CVE-2024-23334.patch \
|
|
file://CVE-2023-49081.patch \
|
|
file://CVE-2024-30251.patch \
|
|
file://CVE-2024-52304.patch \
|
|
file://CVE-2023-49082.patch \
|
|
file://CVE-2024-27306.patch \
|
|
file://CVE-2025-53643.patch \
|
|
file://CVE-2024-23829.patch \
|
|
"
|
|
|
|
SRC_URI[sha256sum] = "b0cf2a4501bff9330a8a5248b4ce951851e415bdcce9dc158e76cfd55e15085c"
|
|
|
|
PYPI_PACKAGE = "aiohttp"
|
|
inherit python_setuptools_build_meta pypi
|
|
|
|
RDEPENDS:${PN} = "\
|
|
${PYTHON_PN}-async-timeout \
|
|
${PYTHON_PN}-attrs \
|
|
${PYTHON_PN}-chardet \
|
|
${PYTHON_PN}-html \
|
|
${PYTHON_PN}-idna-ssl \
|
|
${PYTHON_PN}-json \
|
|
${PYTHON_PN}-misc \
|
|
${PYTHON_PN}-multidict \
|
|
${PYTHON_PN}-netserver \
|
|
${PYTHON_PN}-typing-extensions \
|
|
${PYTHON_PN}-yarl \
|
|
${PYTHON_PN}-cchardet \
|
|
${PYTHON_PN}-charset-normalizer \
|
|
${PYTHON_PN}-aiosignal \
|
|
"
|