aiohttp: Open redirect vulnerability

aiohttp: Open redirect vulnerability An open redirect vulnerability has been discovered in aiohttp. aiohttp 2022-08-10 2022-08-10 772932 remote 3.7.4 3.7.4

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

A bug in aiohttp.web_middlewares.normalize_path_middleware creates an open redirect vulnerability.

An attacker use this vulnerability to craft a link that, while appearing to be a link to an aiohttp-based website, redirects users to an arbitrary attacker-controlled URL.

There is no known workaround at this time.

All aiohttp users should upgrade to the latest version:


          # emerge --sync
          # emerge --ask --oneshot --verbose ">=dev-python/aiohttp-3.7.4"

CVE-2021-21330 GHSA-v6wp-4m6f-gcjg ajak ajak