Wind River Support Network

HomeDefectsLIN1022-7767
Fixed

LIN1022-7767 : Security Advisory - python3-aiohttp - CVE-2024-27306

Created: Apr 18, 2024    Updated: Mar 7, 2025
Resolved Date: Feb 27, 2025
Found In Version: 10.22.33.1
Fix Version: 10.22.33.20
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Userspace

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

CREATE(Triage):(User=admin) CVE-2024-27306 (https://nvd.nist.gov/vuln/detail/CVE-2024-27306)

CVEs

  • Linkedin
  • Facebook
  • Twitter
  • Youtube