mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 18:50:13 +00:00
Code Issues Projects Releases Wiki Activity

python3-aiohttp: fix CVE-2026-34514

Browse Source 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
[2] https://github.com/aio-libs/aiohttp/commit/dab9e879be5606682a39b9dd378900eba0afd1a4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34514

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-09-01 10:18:05 +05:30
committed by Anuj Mittal
parent 334f13cc57
commit b024b3d0d2
2 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34514.patch
+65
View File
@@ -0,0 +1,65 @@
From b3aca47a956826116930a59e482953cacf78830a Mon Sep 17 00:00:00 2001
From: Sam Bull <git@sambull.org>
Date: Sat, 21 Feb 2026 00:17:11 +0000
Subject: [PATCH] Fix multipart injection (#12104) (#12110)
CVE: CVE-2026-34514
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06]
(cherry picked from commit dab9e879be5606682a39b9dd378900eba0afd1a4)
Co-authored-by: mingi jung <mingijung.grape@gmail.com>
(cherry picked from commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
aiohttp/formdata.py | 5 +++++
tests/test_formdata.py | 16 +++++++++++-----
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/aiohttp/formdata.py b/aiohttp/formdata.py
index 2b75b3de7..c14ada176 100644
--- a/aiohttp/formdata.py
+++ b/aiohttp/formdata.py
@@ -79,6 +79,11 @@ class FormData:
raise TypeError(
"content_type must be an instance of str. " "Got: %s" % content_type
)
+ if "\r" in content_type or "\n" in content_type:
+ raise ValueError(
+ "Newline or carriage return detected in headers. "
+ "Potential header injection attack."
+ )
headers[hdrs.CONTENT_TYPE] = content_type
self._is_multipart = True
if content_transfer_encoding is not None:
diff --git a/tests/test_formdata.py b/tests/test_formdata.py
index 4bb8aa075..9e331515c 100644
--- a/tests/test_formdata.py
+++ b/tests/test_formdata.py
@@ -46,12 +46,18 @@ def test_invalid_formdata_params2() -> None:
FormData("as") # 2-char str is not allowed
-def test_invalid_formdata_content_type() -> None:
+@pytest.mark.parametrize("val", (0, 0.1, {}, [], b"foo"))
+def test_invalid_type_formdata_content_type(val: object) -> None:
form = FormData()
- invalid_vals = [0, 0.1, {}, [], b"foo"]
- for invalid_val in invalid_vals:
- with pytest.raises(TypeError):
- form.add_field("foo", "bar", content_type=invalid_val)
+ with pytest.raises(TypeError):
+ form.add_field("foo", "bar", content_type=val) # type: ignore[arg-type]
+
+
+@pytest.mark.parametrize("val", ("\r", "\n", "a\ra\n", "a\na\r"))
+def test_invalid_value_formdata_content_type(val: str) -> None:
+ form = FormData()
+ with pytest.raises(ValueError):
+ form.add_field("foo", "bar", content_type=val)
def test_invalid_formdata_filename() -> None:
--
2.44.4