—
PYSEC-2018-80
Quick fix
PYSEC-2018-80 — aiohttp-session: upgrade to the fixed version with the command below.
pip install --upgrade 'aiohttp-session>=2.4.0'Details
aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/aiohttp-session
Introduced in:
0Fixed in: 2.4.0Fix
pip install --upgrade 'aiohttp-session>=2.4.0'