Homepage
About Snyk

Session Fixation Affecting aiohttp-session package, versions [,2.4.0)

0.0
medium

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Integrity High

    Threat Intelligence

    EPSS 0.09% (37th percentile)
Expand this section
NVD
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-AIOHTTPSESSION-42161
  • published 1 Jul 2018
  • disclosed 26 Jun 2018
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 26 Jun 2018

CVE-2018-1000519 Open this link in a new tab
CWE-384 Open this link in a new tab

Overview

aiohttp-session provides sessions for aiohttp.web.

Affected versions of this package are vulnerable to Session Fixation.

The Get session data function returns an empty dictionary for an empty or invalidated session. save_session takes this data and saves it in Redis.

As a result, an invalidated session will result to the session ID being present in Redis with an empty mapping as its value. If the key (session ID) is not present in Redis, RedisStorage's load_session function would only look at cases where data (returned by reading from Redis) is None. As a result the load_session function would return a session with the presented session ID and not a new one, although there was no valid session in storage for this ID.

##Remediation Upgrade aiohttp-session to version 2.4.0 or higher.