CVE-2018-1000814 aiohttp-session creates non-expiring sessions
Attackers can maintain persistent sessions by reusing expired encrypted cookies, bypassing session expiration controls in aiohttp-session.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000814?
CVE-2018-1000814 is a medium-severity vulnerability in n/a, published on 20 Dec 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Weakness: CWE-613
Which versions are affected by CVE-2018-1000814?
3 open source packages ship an affected version, including aiohttp-session. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp-session PyPI | All versions | 2.7.0 |
aiohttp-session PyPI | All versions | 2.7.0 |
aiohttp-session PyPI | All versions | 2.7.0 |
Products include Aio-Libs Aiohttp Session.
How do I fix CVE-2018-1000814?
Upgrade aiohttp-session to 2.7.0 or later.
Is CVE-2018-1000814 being exploited?
There is no known exploitation of CVE-2018-1000814 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mr4x-c4v9-x729, PYSEC-2018-35.