Debian 11: DLA-4041-1 moderate: multiple issues in python-aiohttp

CVE-2023-47627

The HTTP parser in AIOHTTP has numerous problems with header
parsing, which could lead to request smuggling. This parser is only
used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt
wheel).

CVE-2023-47641

Affected versions of aiohttp have a security vulnerability regarding
the inconsistent interpretation of the http protocol. HTTP/1.1 is a
persistent protocol, if both Content-Length(CL) and
Transfer-Encoding(TE) header values are present it can lead to
incorrect interpretation of two entities that parse the HTTP and we
can poison other sockets with this incorrect interpretation. A
possible Proof-of-Concept (POC) would be a configuration with a
reverse proxy(frontend) that accepts both CL and TE headers and
aiohttp as backend. As aiohttp parses anything with chunked, we can
pass a chunked123 as TE, the frontend entity will ignore this header