PT-2020-6928 · Pypi+4 · Httplib2+4
Published
2020-05-20
·
Updated
2024-07-12
·
CVE-2020-11078
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
httplib2 versions prior to 0.18.0
Description
The issue is related to the httplib2 library's failure to neutralize CRLF sequences, allowing a remote attacker to impact data integrity. In httplib2 before version 0.18.0, an attacker controlling an unescaped part of a URI for
httplib2.Http.request() could change request headers and body, and send additional hidden requests to the same server. This affects software that uses httplib2 with a URI constructed by string concatenation, rather than proper urllib building with escaping.Recommendations
For versions prior to 0.18.0, update to version 0.18.0 or later, where the issue has been fixed by quoting Space, CR, LF characters before any use.
As a temporary workaround, consider creating URIs with
urllib.parse family functions, such as urlencode and urlunsplit, to properly escape user input.Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Centos
Red Hat
Suse
Httplib2