CVE-2020-11078
CRLF injection in httplib2
- State
- Published
- Severity
- 6.8 Medium
- Published
- May 20, 2020
- Updated
- Aug 4, 2024
- Reserved
- Mar 30, 2020
Description
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N | GitHub_M |
Weaknesses
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected Products
| Product | Versions |
|---|---|
httplib2httplib2 |
|
References
- https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
- https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
- [allura-commits] 20200521 [allura] branch master updated: Upgrade httplib2 for CVE-2020-11078mailing-list
- [debian-lts-announce] 20200601 [SECURITY] [DLA 2232-1] python-httplib2 security updatemailing-list
- [beam-issues] 20200602 [jira] [Created] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078mailing-list
- FEDORA-2020-a7a15a9687vendor-advisory
- FEDORA-2020-37779a5c93vendor-advisory
- [beam-issues] 20200802 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078mailing-list
- [beam-issues] 20200802 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078mailing-list
- [beam-issues] 20200816 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078mailing-list
- [beam-issues] 20200816 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.