From 17e53162985db8bf3cc6d2c17b6f004d74d89c36 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 9 Aug 2024 16:51:26 +0000
Subject: [PATCH] Publish GHSA-jwhx-xcg6-8xhj

---
 .../GHSA-jwhx-xcg6-8xhj.json                  | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/08/GHSA-jwhx-xcg6-8xhj/GHSA-jwhx-xcg6-8xhj.json

diff --git a/advisories/github-reviewed/2024/08/GHSA-jwhx-xcg6-8xhj/GHSA-jwhx-xcg6-8xhj.json b/advisories/github-reviewed/2024/08/GHSA-jwhx-xcg6-8xhj/GHSA-jwhx-xcg6-8xhj.json
new file mode 100644
index 00000000000..14535459fd0
--- /dev/null
+++ b/advisories/github-reviewed/2024/08/GHSA-jwhx-xcg6-8xhj/GHSA-jwhx-xcg6-8xhj.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jwhx-xcg6-8xhj",
+  "modified": "2024-08-09T16:49:58Z",
+  "published": "2024-08-09T16:49:58Z",
+  "aliases": [
+    "CVE-2024-42367"
+  ],
+  "summary": "In aiohttp, compressed files as symlinks are not protected from path traversal",
+  "details": "### Summary\nStatic routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.\n\n### Details\nThe server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default).  It does this by resolving the requested URL to an absolute path and then checking that path relative to the root.  However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.\n\n### Impact\nServers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8653/files",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "aiohttp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.10.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/aio-libs/aiohttp/pull/8653"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/aio-libs/aiohttp"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-61"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-08-09T16:49:58Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file