Bug 2327123 (CVE-2024-52303)

Summary:	CVE-2024-52303 aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, anpicker, bdettelb, bparees, brking, caswilli, dfreiber, doconnor, drow, ehelms, ggainey, gtanzill, haoli, hasun, hkataria, jburrell, jcammara, jeder, jfula, jmitchel, jneedle, jowilson, jsamir, jtanner, juwatts, jwong, kaycoth, kegrant, koliveir, kshier, mabashia, mhulan, mminar, nmoumoul, nyancey, omaciel, ometelka, orabin, pbraun, pcreech, ptisnovs, rbiba, rchan, shvarugh, simaishi, smallamp, smcdonal, sskracic, stcannon, sthirugn, syedriko, teagle, tfister, thavo, vkrizan, vkumar, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the aiohttp package. A memory leak can occur in certain configurations when a request produces a `MatchInfoError`. This issue was caused by adding an entry to a cache on each request due to the building of each `MatchInfoError` producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-11-18 21:01:46 UTC

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.