e4451602eb
This fixes the following vulnerability:
- CVE-2025-53643:
In aiohttp prior to version 3.12.14, the Python parser is vulnerable
to a request smuggling vulnerability due to not parsing trailer
sections of an HTTP request. If a pure Python version of aiohttp is
installed (i.e. without the usual C extensions) or
AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to
execute a request smuggling attack to bypass certain firewalls or
proxy protections. Version 3.12.14 contains a patch for this issue.
https://www.cve.org/CVERecord?id=CVE-2025-53643
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
17 lines
635 B
Makefile
17 lines
635 B
Makefile
################################################################################
|
|
#
|
|
# python-aiohttp
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_AIOHTTP_VERSION = 3.12.14
|
|
PYTHON_AIOHTTP_SOURCE = aiohttp-$(PYTHON_AIOHTTP_VERSION).tar.gz
|
|
PYTHON_AIOHTTP_SITE = https://files.pythonhosted.org/packages/e6/0b/e39ad954107ebf213a2325038a3e7a506be3d98e1435e1f82086eec4cde2
|
|
PYTHON_AIOHTTP_SETUP_TYPE = setuptools
|
|
PYTHON_AIOHTTP_LICENSE = Apache-2.0
|
|
PYTHON_AIOHTTP_LICENSE_FILES = LICENSE.txt
|
|
PYTHON_AIOHTTP_CPE_ID_VENDOR = aiohttp
|
|
PYTHON_AIOHTTP_CPE_ID_PRODUCT = aiohttp
|
|
|
|
$(eval $(python-package))
|