Bug 33544 - python-aiohttp new security issues CVE-2024-23334 and CVE-2024-52304
Summary: python-aiohttp new security issues CVE-2024-23334 and CVE-2024-52304
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://ubuntu.com/security/notices/U...
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-09-08 09:50 CEST by Nicolas Salguero
Modified: 2024-12-04 17:59 CET (History)
5 users (show)

See Also:
Source RPM: python-aiohttp-3.8.3-3.1.mga9.src.rpm
CVE: CVE-2024-23334, CVE-2024-52304
Status comment:


Attachments

Description Nicolas Salguero 2024-09-08 09:50:48 CEST
Ubuntu has issued an advisory on September 5:
https://ubuntu.com/security/notices/USN-6991-1
Comment 1 Nicolas Salguero 2024-09-08 09:51:47 CEST
Fix: https://github.com/aio-libs/aiohttp/commit/9118a5831e8a65b8c839eb7e4ac983e040ff41df

Status comment: (none) => Fixed upstream in 3.9.2 and patch available from uptream
Source RPM: (none) => python-aiohttp-3.8.3-3.1.mga9.src.rpm
CVE: (none) => CVE-2024-23334

Comment 2 Marja Van Waes 2024-09-08 17:24:11 CEST
Assigning to our Python Stack Maintainers, CC'ing our registered maintainer.

URL: (none) => https://ubuntu.com/security/notices/USN-6991-1
CC: (none) => marja11, pterjan
Assignee: bugsquad => python

Comment 3 Nicolas Salguero 2024-11-28 16:37:41 CET
SUSE has issued an advisory on November 27:
https://lists.suse.com/pipermail/sle-security-updates/2024-November/019855.html

Status comment: Fixed upstream in 3.9.2 and patch available from uptream => Fixed upstream in 3.10.11 and patch available from uptream
Summary: python-aiohttp new security issue CVE-2024-23334 => python-aiohttp new security issues CVE-2024-23334 and CVE-2024-52304
Source RPM: python-aiohttp-3.8.3-3.1.mga9.src.rpm => python-aiohttp-3.10.10-1.mga10.src.rpm, python-aiohttp-3.8.3-3.1.mga9.src.rpm
CVE: CVE-2024-23334 => CVE-2024-23334, CVE-2024-52304
Whiteboard: (none) => MGA9TOO
Version: 9 => Cauldron

Comment 4 papoteur 2024-12-03 08:28:07 CET
Fixed in Cauldron with 3.11.9 version

Source RPM: python-aiohttp-3.10.10-1.mga10.src.rpm, python-aiohttp-3.8.3-3.1.mga9.src.rpm => python-aiohttp-3.8.3-3.1.mga9.src.rpm
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
CC: (none) => yvesbrungard

Comment 5 papoteur 2024-12-03 10:08:27 CET
Submitting:
SRPMS:
python-aiohttp-3.8.3-3.2.mga9
RPMS:
python3-aiohttp+speedups-3.8.3-3.2.mga9
python3-aiohttp-3.8.3-3.2.mga9
papoteur 2024-12-03 10:08:58 CET

Status comment: Fixed upstream in 3.10.11 and patch available from uptream => (none)
QA Contact: security => qa-bugs

katnatek 2024-12-03 17:39:52 CET

QA Contact: qa-bugs => security
Assignee: python => qa-bugs

katnatek 2024-12-03 20:54:42 CET

Keywords: (none) => advisory

Comment 6 katnatek 2024-12-03 21:10:45 CET
RH x86_64

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing python3-aiohttp+speedups-3.8.3-3.2.mga9.x86_64.rpm python3-aiohttp-3.8.3-3.2.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: python3-aiohttp       ##################################################################################################
      2/2: python3-aiohttp+speedups
                                 ##################################################################################################
      1/2: removing python3-aiohttp+speedups-3.8.3-3.1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing python3-aiohttp-3.8.3-3.1.mga9.x86_64
                                 ##################################################################################################

Reference bug#28490

python3 aio_http_server.py 
======== Running on http://0.0.0.0:8080 ========
(Press CTRL+C to quit)

In other terminal

python3 aio_http_client.py
Status: 200
Content-type: text/html; charset=utf-8
Body: <!doctype html> ...



Open in the browser http://0.0.0.0:8080
Hello, Anonymous

Looks good consistent also with previous update bug#33174

Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm

Comment 7 Thomas Andrews 2024-12-04 00:08:42 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2024-12-04 17:59:50 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0388.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.