python-aiohttp (3.8.4-1+deb12u2) bookworm-security; urgency=medium * Non-maintainer upload by the Debian LTS team. * Enable upstream tests via autopkgtest and recreate aiohttp/_http_parser.c and aiohttp/_http_writer.c to actually apply the code-changes made to the source files. Also, replace re_assert by re in tests. Add python3-trustme to autopkgtest depends to run TLS tests. * d/patches/CVE-2023-47627.patch: Disable C parser tests which won't work with llhttp. Fix a bug in the patch checking chunk sizes. * d/patches/CVE-2024-52304.patch: Fix a bug in the patch. * d/patches/CVE-2025-53643.patch: Add patch to fix CVE-2025-53643. - Fix a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. * d/patches/CVE-2025-69223.patch: Add patch to fix CVE-2025-69223. - Fix a possible zip bomb attack against the AIOHTTP server. * d/patches/CVE-2025-69224.patch: Add patch to fix CVE-2025-69224. - Prevent a request smuggling attack with the presence of non-ASCII characters. * d/patches/CVE-2025-69225.patch: Add patch to fix CVE-2025-69225. - Don't allow non-ASCII decimals to be present in the Range header. * d/patches/CVE-2025-69226.patch: Add patch to fix CVE-2025-69226. - Fix a path traversal vulnerability that allows an attacker to ascertain the existence of path components. * d/patches/CVE-2025-69227.patch: Add patch to fix CVE-2025-69227. - Fix a possible DoS attack. When processing a POST body, an infinite loop can occur when assert statements are bypassed. * d/patches/CVE-2025-69228.patch: Add patch to fix CVE-2025-69228. - Fix a possible DoS attack that can freeze the server by exhausting the memory using Request.post(). * d/patches/CVE-2025-69229-1.patch, d/patches/CVE-2025-69229-2.patch: Add patches to fix CVE-2025-69229. - Fix the handling of chunked messages that can result in an excessive blocking of CPU usage when receiving a large number of chunks. * d/patches/CVE-2026-22815.patch: Add patch to fix CVE-2026-22815. - Fix an uncapped memory usage due to insufficient restrictions in header and trailer handling. * d/patches/CVE-2026-34513.patch: Add patch to fix CVE-2026-34513. - Fix an excessive memory usage possibly resulting in a DoS due to an unbounded DNS cache. * d/patches/CVE-2026-34514.patch: Add patch to fix CVE-2026-34514. - Fix a header injection. * d/patches/CVE-2026-34516.patch: Add patch to fix CVE-2026-34516. - Fix a potential DoS vulnerability caused by a response with an excessive number of multipart headers. * d/patches/CVE-2026-34517.patch: Add patch to fix CVE-2026-34517. - Fix a possible excessive memory usage caused by some multipart form fields due to reading the entire field into memory before checking client_max_size. * d/patches/CVE-2026-34518.patch: Add patch to fix CVE-2026-34518. - Fix leaking sensitive information by dropping the Cookie and the Proxy-Authorization headers when following redirects to a different origin. * d/patches/CVE-2026-34519.patch: Add patch to fix CVE-2026-34519. - Fix a header injection via the reason parameter. * d/patches/CVE-2026-34520.patch: Add patch to fix CVE-2026-34520. - Fix a possible security bypass by checking header values for control characters accordingly to RFC 9110. * d/patches/CVE-2026-34525-1.patch, d/patches/CVE-2026-34525-2.patch: Add patches to fix CVE-2026-34525. - Disallow duplicate headers, like host headers, except for in lax mode. * d/patches/CVE-2026-34993.patch: Add patch to fix CVE-2026-34993. - Fix an arbitrary code execution vulnerability when using CookieJar.load() with untrusted input (closes: #1138781). * d/patches/CVE-2026-47265.patch: Add patch to fix CVE-2026-47265. - Fix a possible data leak (closes: #1138780). * d/patches/CVE-2026-50269.patch: Add patch to fix CVE-2026-50269. - Fix a possible header injection. An attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. * d/patches/CVE-2026-54274.patch: Add patch to fix CVE-2026-54274. - Fix an issue where an attacker sends large incomplete websocket frame payloads and bypasses the usual size limits on memory use. * d/patches/CVE-2026-54277.patch: Add patch to fix CVE-2026-54277. - Fix an issue where an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. * d/patches/CVE-2026-54279.patch: Add patch to fix CVE-2026-54279. - Fix an issue where host-only cookies that are saved with CookieJar.save() and then later restored with CookieJar.load() lose their host-only status. * d/patches/CVE-2026-54280.patch: Add patch to fix CVE-2026-54280. - Fix a possible resource starvation caused when payload resources are not closed correctly when a client disconnects in the middle of a write. * d/patches/CVE-2026-59881.patch: Add patch to fix CVE-2026-59881. - The WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption (closes: #1143160). * d/patches/CVE-2026-69243.patch: Add patch to fix CVE-2026-69243. - The HTTP parsers are vulnerable to a request smuggling attack relating to WebSocket upgrades (closes: #1143597). -- Daniel Leidert Fri, 02 Oct 2026 08:22:14 +0200 python-aiohttp (3.8.4-1+deb12u1) bookworm-security; urgency=medium * CVE-2023-47627 * CVE-2023-49081 (Closes: #1057163) * CVE-2023-49082 (Closes: #1057164) * CVE-2024-23334 (Closes: #1062709) * CVE-2024-30251 (Closes: #1070364) * CVE-2024-52304 (Closes: #1088109) -- Moritz Mühlenhoff Thu, 28 Nov 2024 20:38:32 +0100 python-aiohttp (3.8.4-1) unstable; urgency=medium [ Debian Janitor ] * Update standards version to 4.6.2, no changes needed. [ Piotr Ożarowski ] * New upstream release -- Piotr Ożarowski Thu, 16 Feb 2023 11:54:52 +0100 python-aiohttp (3.8.3-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Mon, 31 Oct 2022 09:58:46 +0100 python-aiohttp (3.8.1-5) unstable; urgency=medium [ Debian Janitor ] * Remove constraints unnecessary since buster (oldstable): + Build-Depends: Drop versioned constraint on python3-all-dev and python3-yarl. + python3-aiohttp: Drop versioned constraint on python3-yarl in Depends. -- Jelmer Vernooij Fri, 14 Oct 2022 11:57:30 +0100 python-aiohttp (3.8.1-4) unstable; urgency=high * Team upload. * debian/control: Add versioned dependency (Closes: #1001642): + python3-async-timeout (>= 4.0.1) * debian/py3dist-overrides: Add "idna_ssl python3-idna-ssl" line to suppress build error raised by newer dh_python3. -- Boyuan Yang Sun, 19 Dec 2021 01:05:53 -0500 python-aiohttp (3.8.1-3) unstable; urgency=medium * Add python3-charset-normalizer to (Build-)Depends (closes: 1000848) -- Piotr Ożarowski Tue, 30 Nov 2021 13:58:24 +0100 python-aiohttp (3.8.1-2) unstable; urgency=medium * New upstream release (closes: 1000680) * docs: temporarily remove news (sphinxcontrib.towncrier is not yet packaged) -- Piotr Ożarowski Sat, 27 Nov 2021 17:20:40 +0100 python-aiohttp (3.7.4-2) unstable; urgency=medium * Team upload. [ Diego M. Rodriguez ] * d/control: add sphinx dependencies to doc package (Closes: #990652) [ Debian Janitor ] * Apply multi-arch hints. + python-aiohttp-doc: Add Multi-Arch: foreign. * Bump debhelper from old 12 to 13. [ Boyuan Yang ] * debian/: Drop manual -dbg package. (Closes: #994345) * debian/control: Bump Standards-Version to 4.6.0. -- Boyuan Yang Tue, 16 Nov 2021 12:03:24 -0500 python-aiohttp (3.7.4-1) unstable; urgency=high * Team upload * New upstream version 3.7.4 * Fixes only an openredirect issue in normalize_path_middleware middleware (CVE-2021-21330) and is thus suitable for bullseye. -- Raphaël Hertzog Fri, 26 Feb 2021 09:39:16 +0100 python-aiohttp (3.7.3-2) unstable; urgency=medium * No change rebuild. -- Andrej Shadura Fri, 26 Feb 2021 09:11:31 +0100 python-aiohttp (3.7.3-1) unstable; urgency=medium [ Emmanuel Arias ] * Add python-aiohttp-doc package (Closes: #950331) - Add d/python-aiohttp-doc* files. - d/rules: add override_dh_auto_build for build documentation. - d/control: add python3-sphinxcontrib.blockdiag depends for build documentation. [ Ondřej Nový ] * d/control: Update Maintainer field with new Debian Python Team contact address. * d/control: Update Vcs-* fields with new Debian Python Team Salsa layout. [ Debian Janitor ] * Set field Upstream-Name in debian/copyright. * Remove obsolete field Name from debian/upstream/metadata (already present in machine-readable debian/copyright). [ Piotr Ożarowski ] * New upstream release * Patch documentation to remove "fork me on Github" button (privacy breach) * Standards-Version bumped to 4.5.1 (no changes needed) * Update debian/copyright to mention vendor/http-parser files -- Piotr Ożarowski Fri, 15 Jan 2021 20:52:09 +0100 python-aiohttp (3.6.2-1) unstable; urgency=medium [ Ondřej Nový ] * Bump Standards-Version to 4.4.1. [ William Grzybowski ] * New upstream release * d/control: - Add Rules-Requires-Root: no - Add sphinxdoc to package Depends - Update Standards-Version to 4.4.1 * d/patches: add patch 0002 to add shebang to examples -- William Grzybowski Wed, 23 Oct 2019 09:51:01 -0300 python-aiohttp (3.6.1-1) unstable; urgency=medium * New upstream release -- William Grzybowski Mon, 23 Sep 2019 16:51:58 -0300 python-aiohttp (3.6.0-1) unstable; urgency=medium * New upstream release * d/watch: use version 4 and ignore alpha/beta/rc -- William Grzybowski Tue, 17 Sep 2019 14:38:53 -0300 python-aiohttp (3.5.4-1) unstable; urgency=medium [ William Grzybowski ] * New upstream version 3.5.4 * Add debian/salsa-ci.yml * d/control: add myself to Uploaders * d/control: update debhelper to version 12 * d/copyright: adjust upstream years and remove debian/idna_ssl.py * d/python3-aiohttp.pyremove: also remove *.pxd and *.pxi * d/rules: run dwz only in the debug package * Remove header files using pyremove and not rules [ Ondřej Nový ] * Use debhelper-compat instead of debian/compat. * Bump Standards-Version to 4.4.0. * d/control: Remove ancient X-Python3-Version field. -- William Grzybowski Fri, 26 Jul 2019 16:17:15 -0300 python-aiohttp (3.5.1-1) unstable; urgency=medium * New upstream release * Remove idna_ssl patch - no longer needed in Python >= 3.7 * Standards-Version bumped to 4.3.0 (no changes needed) -- Piotr Ożarowski Mon, 31 Dec 2018 18:15:56 +0100 python-aiohttp (3.4.4-1~exp1) experimental; urgency=medium * Team upload * New upstream release (Closes: #901010) * debian/control: - New standards version 4.2.1 - no changes - Recommends libjs-jquery * debian/gbp.conf: Enable pristine-tar build * debian/patches: - Refresh patches - debian/patches/0002-Use-local-install-of-jquery.patch (fixes lintian) * debian/rules: - Do not delete aiohttp/_*.c in override_dh_auto_clean - Delete _find_header.h from binary packages -- Ruben Undheim Fri, 21 Dec 2018 18:32:14 +0000 python-aiohttp (3.1.3-1) unstable; urgency=medium * Team upload. * New upstream release * d/copyright: Fix Format URL to correct one * d/rules: Remove trailing whitespaces * Bump debhelper compat level to 11 * Standards-Version is 4.2.0 now (no changes needed) * Enable autopkgtest-pkg-python testsuite * Install examples * Really bump required Python 3 version to 3.5.3 * Enable all hardening * Add upstream metadata * d/copyright: Change Source to new location * Convert git repository from git-dpm to gbp layout * Require python3-yarl at least 1.0 (Closes: #897432) -- Ondřej Nový Tue, 14 Aug 2018 14:53:26 +0200 python-aiohttp (3.0.1-1) unstable; urgency=medium [ Ondřej Nový ] * d/control: Set Vcs-* to salsa.debian.org [ Piotr Ożarowski ] * New upstream release - minimum required Python 3 version bumped to 3.5.3 * bundle idna_ssl module until Python 3.7 is the one supported in Debian -- Piotr Ożarowski Wed, 14 Feb 2018 12:59:09 +0100 python-aiohttp (2.3.6-1) unstable; urgency=medium * New upstream release * Standards-Version bumped to 4.1.2 (d/copyright format URL switch to HTTPS) -- Piotr Ożarowski Wed, 20 Dec 2017 12:01:51 +0100 python-aiohttp (2.2.3-2) unstable; urgency=medium * Team upload. * d/rules: clean generated C files. Closes: #880352. * d/control: bump Standards-Version to 4.1.1. * d/watch: switch to HTTPS. -- Vincent Bernat Sun, 26 Nov 2017 19:06:47 +0100 python-aiohttp (2.2.3-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Sun, 09 Jul 2017 22:53:16 +0200 python-aiohttp (2.2.0-1) unstable; urgency=medium * New upstream release * Standards-Version bumped to 4.0.0 (no changes needed) -- Piotr Ożarowski Fri, 23 Jun 2017 19:50:46 +0200 python-aiohttp (1.2.0-1) unstable; urgency=medium * New upstream release * debian/compat changed to 10 (this change also closes: 845178 thanks to dh_autoreconf) -- Piotr Ożarowski Wed, 21 Dec 2016 13:30:27 +0100 python-aiohttp (1.1.5-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Fri, 18 Nov 2016 19:58:04 +0100 python-aiohttp (1.1.2-1) unstable; urgency=medium * New upstream release - works with new multidict (closes: 835299) - decompresses HTTP bodies (closes: 833254) * tests disabled for now (see comment in debian/rules) closes: 830567, 839478 -- Piotr Ożarowski Tue, 08 Nov 2016 22:58:56 +0100 python-aiohttp (0.22.4-1) unstable; urgency=medium [ Ondřej Nový ] * Fixed VCS URL (https) [ Piotr Ożarowski ] * New upstream release - Add dependency on python3-multidict * Backport changes in test/test_connector.py from upstream master branch * Standards-Version bumped to 3.9.8 (no changes needed) -- Piotr Ożarowski Thu, 28 Jul 2016 23:32:19 +0200 python-aiohttp (0.20.2-1) unstable; urgency=medium * New upstream release. * Replace python3-nose with python3-pytest in Build-Depends and remove override_dh_auto_test from debian/rules; remove no longer needed override_dh_auto_test in debian/rules * Remove .cache directory in clean target -- Piotr Ożarowski Thu, 28 Jan 2016 21:42:23 +0100 python-aiohttp (0.17.4-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Tue, 29 Sep 2015 23:12:42 +0200 python-aiohttp (0.17.2-1) unstable; urgency=medium * Team upload. * New upstream release. * d/patches/no-gunicorn.patch: Deleted; we have python3-gunicorn now. * d/control: Add python3-gunicorn to Build-Depends. * d/rules: override_dh_auto_test until pybuild bug #749506 is fixed. -- Barry Warsaw Thu, 13 Aug 2015 16:12:29 -0400 python-aiohttp (0.15.3-1) unstable; urgency=medium * Update to 0.15.3 upstream release. -- Tianon Gravi Sun, 03 May 2015 06:44:18 +0000 python-aiohttp (0.15.1-1) unstable; urgency=medium * Initial release. -- Tianon Gravi Sat, 04 Apr 2015 09:07:00 -0600