CVE-2024-42367

Advisory

Mdapi updates its dependency aiohttp to v3.10.2 due to the CVE-2024-42367.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Breaking Changes
* EOL'd releases are no longer indexed in the API

What's Changed
* Baseline v3.1.5 as the default MDAPI version by gridhead in https://github.com/fedora-infra/mdapi/pull/258
* Fix the daemon downloading content frequently by gridhead in https://github.com/fedora-infra/mdapi/pull/259
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/260
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/263
* chore(deps): update dependency ruff to ^0.2.0 || ^0.3.0 || ^0.4.0 by renovate in https://github.com/fedora-infra/mdapi/pull/264
* fix(deps): update dependency gunicorn to v22 by renovate in https://github.com/fedora-infra/mdapi/pull/262
* Bump gunicorn from 21.2.0 to 22.0.0 by dependabot in https://github.com/fedora-infra/mdapi/pull/261
* Make a bid to fix UP031 errors by gridhead in https://github.com/fedora-infra/mdapi/pull/268
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/265
* Make necessary changes to the documentation by gridhead in https://github.com/fedora-infra/mdapi/pull/269
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/270
* fix(deps): update dependency pyzstd to ^0.15.0 || ^0.16.0 by renovate in https://github.com/fedora-infra/mdapi/pull/271
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/272
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/273
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/274
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/275
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/276
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/277
* chore(deps): update dependency ruff to ^0.2.0 || ^0.3.0 || ^0.4.0 || ^0.5.0 by renovate in https://github.com/fedora-infra/mdapi/pull/278
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/279
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/280
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/281
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/282
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/283
* fix(deps): update dependency aiohttp to v3.10.2 [security] by renovate in https://github.com/fedora-infra/mdapi/pull/285
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/286
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/289
* chore(deps): update dependency ruff to ^0.2.0 || ^0.3.0 || ^0.4.0 || ^0.5.0 || ^0.6.0 by renovate in https://github.com/fedora-infra/mdapi/pull/290
* fix(deps): update dependency uvloop to ^0.17.0 || ^0.18.0 || ^0.19.0 || ^0.20.0 by renovate in https://github.com/fedora-infra/mdapi/pull/291
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/292
* chore(deps): automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/293
* database/main.py: Simplify EPEL URL logic by ashcrow in https://github.com/fedora-infra/mdapi/pull/284
* Bump version from v3.1.6a1 to v3.1.6a2 by gridhead in https://github.com/fedora-infra/mdapi/pull/294
* Rework the branch fetching technique by gridhead in https://github.com/fedora-infra/mdapi/pull/296
* Adjust branch fetching to account for EPEL 10 minor versions by carlwgeorge in https://github.com/fedora-infra/mdapi/pull/297
* Step up from MDAPI `v3.1.6a3` to `v3.1.6a4` by gridhead in https://github.com/fedora-infra/mdapi/pull/299
* Fix logging error while indexing by gridhead in https://github.com/fedora-infra/mdapi/pull/300
* Step up from MDAPI v3.1.6a4 to v3.1.6a5 by gridhead in https://github.com/fedora-infra/mdapi/pull/301
* Avoid skipping valid branches while indexing repos by carlwgeorge in https://github.com/fedora-infra/mdapi/pull/302
* Automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/303
* Automated dependency updates by renovate in https://github.com/fedora-infra/mdapi/pull/304
* Address times when branches would be zero by gridhead in https://github.com/fedora-infra/mdapi/pull/305
* Version bump from `v3.1.6a6` to `v3.1.6` by gridhead in https://github.com/fedora-infra/mdapi/pull/306

New Contributors
* ashcrow made their first contribution in https://github.com/fedora-infra/mdapi/pull/284
* carlwgeorge made their first contribution in https://github.com/fedora-infra/mdapi/pull/297

**Full Changelog**: https://github.com/fedora-infra/mdapi/compare/3.1.5...3.1.6

Resources

• https://github.com/fedora-infra/mdapi/pull/285
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42367