What is GHSA-mr4x-c4v9-x729?

GHSA-mr4x-c4v9-x729 is a security advisory published by GitHub Security Advisories with High severity. aiohttp-session creates non-expiring sessions

Which CVE IDs does GHSA-mr4x-c4v9-x729 cover?

GHSA-mr4x-c4v9-x729 covers the following CVE IDs: CVE-2018-1000814. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mr4x-c4v9-x729?

GHSA-mr4x-c4v9-x729 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-mr4x-c4v9-x729?

GHSA-mr4x-c4v9-x729 affects 1 product, including: pip/aiohttp-session:\u003c= 2.6.0.

GHSA-mr4x-c4v9-x729HighCVSS 6.5

aiohttp-session creates non-expiring sessions

Vendor

GitHub Security Advisories

Published

December 20, 2018

Last Modified

March 14, 2025

🔗 CVE IDs covered (1)

CVE-2018-1000814 →

📋 Description

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

🎯 Affected products1

pip/aiohttp-session:<= 2.6.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000814
https://github.com/aio-libs/aiohttp-session/issues/325
https://github.com/aio-libs/aiohttp-session/pull/331
https://github.com/advisories/GHSA-mr4x-c4v9-x729
https://github.com/aio-libs/aiohttp-session/commit/1b356f01bbab57d041c9a75bacd72fbbf8524728
https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp-session/PYSEC-2018-35.yaml