Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update aiohttp minimum dependency version to 3.8.0 #384

Closed
irangareddy opened this issue Feb 9, 2023 · 1 comment
Closed

update aiohttp minimum dependency version to 3.8.0 #384

irangareddy opened this issue Feb 9, 2023 · 1 comment
Labels
type: chore Changes to the build process or auxiliary tools and libraries such as documentation generation

Comments

@irangareddy
Copy link

irangareddy commented Feb 9, 2023

Describe the bug
Aiohttp 3.8.0 adds validation of HTTP header keys and values to prevent header injection
AFFECTED VERSIONS: <3.8.0
FIXED VERSIONS: 3.8.0

more about the vulnerability: https://pyup.io/vulnerabilities/PVE-2021-42692/42692/

To Reproduce
On any poetry python project, do following commands

clone https://github.com/eccenca/cmem-plugin-graphql

- cd cmem-plugin-graphql
- git checkout feature/mutationSupport-ECC-5299
- task poetry:install
- task check:safety

Expected behavior
on poetry run safety check all safety checks should pass.

System info:

  • OS: macOS 13.1
  • Python version: Python 3.9.6
  • gql version:
    gql 3.4.0 GraphQL client for Python
    ├── aiohttp >=3.7.1,<3.9.0
  • graphql-core version: graphql-core >=3.2,<3.3
@leszekhanusz
Copy link
Collaborator

I cannot see the vulnerability as I don't have a pyup.io account and it is impossible to register with a gmail email address...

But I suspect that the vulnerability concerns only the server part of aiohttp and not the client so that is probably not a problem for gql.

@leszekhanusz leszekhanusz added the type: chore Changes to the build process or auxiliary tools and libraries such as documentation generation label Feb 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: chore Changes to the build process or auxiliary tools and libraries such as documentation generation
Projects
None yet
Development

No branches or pull requests

2 participants