high6.5
CVE-2018-1000814
aiohttp-session creates non-expiring sessions
Impact
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | aiohttp-session | <= 2.6.0 | 2.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aio-Libs | Aiohttp Session | through 2.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/aio-libs/aiohttp-session/issues/325
- https://github.com/aio-libs/aiohttp-session/pull/331
- https://github.com/advisories/GHSA-mr4x-c4v9-x729
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000814
- https://github.com/aio-libs/aiohttp-session/commit/1b356f01bbab57d041c9a75bacd72fbbf8524728
- https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp-session/PYSEC-2018-35.yaml