Hackers exploit Aiohttp bug to find vulnerable networks

bleepingcomputer.com

11 pointsjulienreszka5 comments

Ugh. We're forever pinned on 3.8.1 since they broke task cancellation in 3.8.3. The handling of that is frustrating, we won't be using aio http for new projects.

https://github.com/aio-libs/aiohttp/issues/6719

You might be able to fork and use just this patch: https://github.com/aio-libs/aiohttp/pull/7835/files

I found it on this page: https://github.com/advisories/GHSA-q3qx-c6g2-7pw2

That commit has nothing at all to do with task cancellation.

It's for fixing the vulnerability.

Is this less serious if you have some reverse proxy not passing the Connection header on?

Reply on news.ycombinator.com