mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-12 03:24:08 +00:00
65523c22aa
aiohttp is an asynchronous HTTP client/server framework for asyncio and
Python. Prior to version 3.10.2, static routes which contain files with
compressed variants (`.gz` or `.br` extension) are vulnerable to path
traversal outside the root directory if those variants are symbolic
links. The server protects static routes from path traversal outside the
root directory when `follow_symlinks=False` (default). It does this by
resolving the requested URL to an absolute path and then checking that
path relative to the root. However, these checks are not performed when
looking for compressed variants in the `FileResponse` class, and
symbolic links are then automatically followed when performing the
`Path.stat()` and `Path.open()` to send the file. Version 3.10.2
contains a patch for the issue.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-42367
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj
Upstream patch:
ce2e975881
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
37 lines
1.1 KiB
BlitzBasic
37 lines
1.1 KiB
BlitzBasic
SUMMARY = "Async http client/server framework"
|
|
DESCRIPTION = "Asynchronous HTTP client/server framework for asyncio and Python"
|
|
HOMEPAGE = "https://github.com/aio-libs/aiohttp"
|
|
LICENSE = "Apache-2.0"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=748073912af33aa59430d3702aa32d41"
|
|
|
|
SRC_URI += "file://CVE-2024-23334.patch \
|
|
file://CVE-2023-49081.patch \
|
|
file://CVE-2024-30251.patch \
|
|
file://CVE-2024-52304.patch \
|
|
file://CVE-2023-49082.patch \
|
|
file://CVE-2024-27306.patch \
|
|
file://CVE-2024-42367.patch \
|
|
"
|
|
|
|
SRC_URI[sha256sum] = "b0cf2a4501bff9330a8a5248b4ce951851e415bdcce9dc158e76cfd55e15085c"
|
|
|
|
PYPI_PACKAGE = "aiohttp"
|
|
inherit python_setuptools_build_meta pypi
|
|
|
|
RDEPENDS:${PN} = "\
|
|
${PYTHON_PN}-async-timeout \
|
|
${PYTHON_PN}-attrs \
|
|
${PYTHON_PN}-chardet \
|
|
${PYTHON_PN}-html \
|
|
${PYTHON_PN}-idna-ssl \
|
|
${PYTHON_PN}-json \
|
|
${PYTHON_PN}-misc \
|
|
${PYTHON_PN}-multidict \
|
|
${PYTHON_PN}-netserver \
|
|
${PYTHON_PN}-typing-extensions \
|
|
${PYTHON_PN}-yarl \
|
|
${PYTHON_PN}-cchardet \
|
|
${PYTHON_PN}-charset-normalizer \
|
|
${PYTHON_PN}-aiosignal \
|
|
"
|