From e4451602ebee8ef6f6b354e8f9b6dcc80206f079 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Wed, 16 Jul 2025 12:21:59 +0200 Subject: [PATCH] package/python-aiohttp: security bump to v3.12.14 This fixes the following vulnerability: - CVE-2025-53643: In aiohttp prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue. https://www.cve.org/CVERecord?id=CVE-2025-53643 Signed-off-by: Titouan Christophe Signed-off-by: Arnout Vandecappelle --- package/python-aiohttp/python-aiohttp.hash | 4 ++-- package/python-aiohttp/python-aiohttp.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-aiohttp/python-aiohttp.hash b/package/python-aiohttp/python-aiohttp.hash index ac12cafeea..0aa8dbd3bc 100644 --- a/package/python-aiohttp/python-aiohttp.hash +++ b/package/python-aiohttp/python-aiohttp.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/aiohttp/json -md5 7835f28e41adf6f09467533e8de0c199 aiohttp-3.11.14.tar.gz -sha256 d6edc538c7480fa0a3b2bdd705f8010062d74700198da55d16498e1b49549b9c aiohttp-3.11.14.tar.gz +md5 4ed66dcec63108ae3a7c01d0415b4dd9 aiohttp-3.12.14.tar.gz +sha256 6e06e120e34d93100de448fd941522e11dafa78ef1a893c179901b7d66aa29f2 aiohttp-3.12.14.tar.gz # Locally computed sha256 checksums sha256 9f80d0db7d755a941db4572172c270ecbd8f082ba215ddd095985942ed94a9eb LICENSE.txt diff --git a/package/python-aiohttp/python-aiohttp.mk b/package/python-aiohttp/python-aiohttp.mk index d3e7d12eb6..e52b6e81c5 100644 --- a/package/python-aiohttp/python-aiohttp.mk +++ b/package/python-aiohttp/python-aiohttp.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_AIOHTTP_VERSION = 3.11.14 +PYTHON_AIOHTTP_VERSION = 3.12.14 PYTHON_AIOHTTP_SOURCE = aiohttp-$(PYTHON_AIOHTTP_VERSION).tar.gz -PYTHON_AIOHTTP_SITE = https://files.pythonhosted.org/packages/6c/96/91e93ae5fd04d428c101cdbabce6c820d284d61d2614d00518f4fa52ea24 +PYTHON_AIOHTTP_SITE = https://files.pythonhosted.org/packages/e6/0b/e39ad954107ebf213a2325038a3e7a506be3d98e1435e1f82086eec4cde2 PYTHON_AIOHTTP_SETUP_TYPE = setuptools PYTHON_AIOHTTP_LICENSE = Apache-2.0 PYTHON_AIOHTTP_LICENSE_FILES = LICENSE.txt