-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 16 Jun 2024 12:39:52 +0100
Source: python-aiohttp
Architecture: source
Version: 3.9.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1062708 1062709 1070364 1070665
Changes:
python-aiohttp (3.9.5-1) unstable; urgency=medium
.
* Team upload.
* Use pybuild-plugin-pyproject.
* New upstream release:
- CVE-2024-23829: Python HTTP parser still overly lenient about
separators (closes: #1062708).
- CVE-2024-23334: aiohttp.web.static(follow_symlinks=True) is vulnerable
to directory traversal (closes: #1062709).
- CVE-2024-30251: DoS when trying to parse malformed POST requests
(closes: #1070364).
- CVE-2024-27306: XSS on index pages for static file handling (closes:
#1070665).
* Standards-Version: 3.7.0 (no changes required).
Checksums-Sha1:
d288a65fa8f8065ecebbc31c9ce616223f97e11e 2559 python-aiohttp_3.9.5-1.dsc
ea93f981c278c7a46157a4aab6088a3d933ce0c8 7504841 python-aiohttp_3.9.5.orig.tar.gz
821c85b6c30ceeca490767c7f7ec2fbd5e755b9c 7740 python-aiohttp_3.9.5-1.debian.tar.xz
07ad80d5996b6a65fda2f8de5a42b304abd8e200 7728 python-aiohttp_3.9.5-1_source.buildinfo
Checksums-Sha256:
764d5b9fb904114fb507e1e31c809c8bb80847ea498ed12873c8e6bde242e79b 2559 python-aiohttp_3.9.5-1.dsc
edea7d15772ceeb29db4aff55e482d4bcfb6ae160ce144f2682de02f6d693551 7504841 python-aiohttp_3.9.5.orig.tar.gz
6e97d2538d6b30e61f823466f89f3923cbd66c6d11c3c00ff838b0e18bd7302f 7740 python-aiohttp_3.9.5-1.debian.tar.xz
f61c6dc5e539511a8ffacf8bf00b40e9eb8384576864ab263708540b7a1222d2 7728 python-aiohttp_3.9.5-1_source.buildinfo
Files:
6727b35aa3877d0ae80e198bd38d8d5a 2559 python optional python-aiohttp_3.9.5-1.dsc
14829a5ea507c8219e3f679fceeb5585 7504841 python optional python-aiohttp_3.9.5.orig.tar.gz
b96f47c3d6cc156ded1b9b1827b511dd 7740 python optional python-aiohttp_3.9.5-1.debian.tar.xz
b103e3474df223de8bf18b866646173f 7728 python optional python-aiohttp_3.9.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmZuz0MACgkQOTWH2X2G
UAtW0A/7BG+9G8KTt0FBxw4uzluILbJZpDMCqvOS6uKrj+880l/kB3/glL/qczVl
pFeb64yo4bc2Ls/QjwZ3V085BzEoPClC+AKKX9Sgo5EDWwwyRiLpGtbDUgrxN71U
NH7tX3Y/J4XyD+yVeqbsi1iVi8njTPsJyUiKAEz0hxaPokyCugA9iKJNFDlYmeh9
XWLfcAig2HyGgxUqBqvG8mXjQC6ZmqdIw6RDEJxUow73F45j2Y6gxMvGwrPAcbUD
yz7S9VPSgrSnmmBbNaLY4MD+ATsg3Jg+ryi18DpYHDn4e1E9Yc6TI/f1AJZyr5v4
/tC+nKEQ5xHM5ZsMELLN1TFeCOVAIqYTJLywO18/dnd4l//Z6xMRfEi6H+irn55q
1j1fJYJr2yQSb0HBUlHJIq46/XXTWbWjizH3Fn8GVDerFkYg2JVLcbMhr97amej7
cnDSZcVafEecWoXKiTBftWRSJfHbTQKget9l1rPwue1qrNezGEAmstPhYI6ZCvqM
KmT6UsS6dzQGSaLqAUsJV3hDkVUoUb8WHYrRUo11gtsFiVXGJqjKLh04Q3lDby8o
//m9jYeCjxAmSeRroWctqDNzLaSv0gPnwVN6lpYXEZFuSojrdJw0tJ/9rBjdxrfT
TlenG8tMJ279wpTkIFdyOhGCxBuboEuBNWr60Oh+iCqeH8v4TJ0=
=t1c8
-----END PGP SIGNATURE-----
Attachment:
pgpZ5g6d6KS3W.pgp
Description: PGP signature