Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 918968 (CVE-2023-49082) - <dev-python/aiohttp-3.9.0: CLRF injection via method
Summary: <dev-python/aiohttp-3.9.0: CLRF injection via method
Alias: CVE-2023-49082
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa?]
Depends on:
Reported: 2023-12-01 18:14 UTC by Christopher Fore
Modified: 2023-12-22 01:25 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Fore 2023-12-01 18:14:15 UTC
CVE-2023-49082 (

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-12-22 01:25:33 UTC
Tree is clean:

commit 0482e646047d37536afc26291d6374b31ec03550
Author: Michał Górny <>
Date:   Sun Dec 10 15:24:38 2023 +0100

    dev-python/aiohttp: Remove old

    Signed-off-by: Michał Górny <>