PT-2021-6101 · Pypi+4 · Httplib2+4

Ben Caller · Published 2021-02-08 · Updated 2026-03-21 · CVE-2021-21240

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.19.0

Description A malicious server which responds with long series of xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. The issue arises due to catastrophic backtracking in the vulnerable regular expression, leading to cubic complexity and significant processing delays.

Recommendations For versions prior to 0.19.0, update to version 0.19.0, which contains a new implementation of auth headers parsing using the pyparsing library. As a temporary workaround, consider setting httplib2.USE WWW AUTH STRICT PARSING to True to mitigate the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-00801

CVE-2021-21240

GHSA-93XJ-8MRV-444M

MGASA-2021-0122

OESA-2021-1126

OPENSUSE-SU-2021:0772-1

OPENSUSE-SU-2021:0796-1

OPENSUSE-SU-2021:1806-1

OPENSUSE-SU-2021_0772-1

OPENSUSE-SU-2021_1806-1

OPENSUSE-SU-2024:11231-1

OPENSUSE-SU-2024:14141-1

PYSEC-2021-16

RHSA-2021:2116

SUSE-SU-2021:1637-1

SUSE-SU-2021:1779-1

SUSE-SU-2021:1806-1

SUSE-SU-2021:1807-1

SUSE-SU-2021:1808-1

Affected Products

Astra Linux

Debian

Red Os

Suse

Httplib2

References · 51

• 🔥 https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m · Exploit
• https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc · Patch
• https://github.com/httplib2/httplib2/pull/182 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2021:1806-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21240 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14141-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1807-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1779-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11231-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0122.html · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0772-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21240 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1126 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1637-1 · Vendor Advisory