VDB

GHSA-jwhx-xcg6-8xhj

GHSA-jwhx-xcg6-8xhj PUBLISHED CVSS 4.800000190734863 MEDIUM

In aiohttp, compressed files as symlinks are not protected from path traversal

Record from GitHub Advisory Database · Published August 9, 2024

aiohttp is fixed in 3.10.2 (PyPI)

In aiohttp, compressed files as symlinks are not protected from path traversal

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
aiohttpPyPI3.10.2
gitlab-cng-ee-17.1Chainguard17.1.4-r0
checkovChainguard3.0.34-r1
nemoChainguard1.23.0-r12
gitlab-cng-ee-17.2Chainguard17.2.2-r0
dask-gatewayWolfi2024.1.0-r9
checkovWolfi3.0.34-r1
dask-gatewayChainguard2024.1.0-r9
kserveChainguard0.13.1-r3
kserveWolfi0.13.1-r3
airflowChainguard2.9.3-r2
gitlab-cng-ee-17.0Chainguard17.0.6-r0

4 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

VendorProductVersions
chainguardgitlab-cng-ee-17.10
chainguardcheckov0
chainguardnemo0
chainguardgitlab-cng-ee-17.20
wolfidask-gateway0
wolficheckov0
chainguarddask-gateway0
chainguardkserve0
wolfikserve0
chainguardairflow0
chainguardgitlab-cng-ee-17.00
wolfiairflow0
chainguardrequest-12760
wolfipy3-cassandra-medusa0
chainguardpy3-cassandra-medusa0
PyPIaiohttp3.10.0b1
PyPIaiohttp

Timeline

  • Aug 9, 2024 CVE Published
  • Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-jwhx-xcg6-8xhj
vulnetix vdb fixes GHSA-jwhx-xcg6-8xhj

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-jwhx-xcg6-8xhj/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›