p PatchFirst

CVE-2020-11078

CVE-2020-11078 · CRLF injection in httplib2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

CVSS 6.8 · Medium · EPSS 2.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • httplib2

    Versions
    • < 0.81.0: Affected

    No fix published

  • python-httplib2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.18.1-1

    Update to 0.18.1-1

  • python-httplib2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.18.1-1

    Update to 0.18.1-1

  • python-httplib2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.18.1-1

    Update to 0.18.1-1

  • httplib2 PyPI

    Versions
    • 0.10.3
    • 0.11.0
    • 0.11.1
    • 0.11.3
    • 0.12.0
    • 0.12.1
    • 0.12.3
    • 0.13.0
    • 0.13.1
    • 0.14.0
    • 0.15.0
    • 0.16.0
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8
    • 0.9
    • 0.9.1
    • 0.9.2
    Affected ranges
    • ECOSYSTEM: < 0.18.0

    Update to 0.18.0

  • httplib2 PyPI

    Versions
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8
    • 0.9
    • 0.9.1
    • 0.9.2
    • 0.10.3
    • 0.11.0
    • 0.11.1
    • 0.11.3
    • 0.12.0
    • 0.12.1
    • 0.12.3
    • 0.13.0
    • 0.13.1
    • 0.14.0
    • 0.15.0
    • 0.16.0
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    Affected ranges
    • GIT: < a1457cc31f3206cf691d11d2bf34e98865873e9e
    • ECOSYSTEM: < 0.18.0

    Update to 0.18.0

  • python-httplib2 Ubuntu:14.04:LTS

    Versions
    • 0.8-2
    • 0.8-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-httplib2 Ubuntu:16.04:LTS

    Versions
    • 0.9+dfsg-2
    • 0.9.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-httplib2 Ubuntu:18.04:LTS

    Versions
    • 0.9.2+dfsg-1
    • 0.9.2+dfsg-1ubuntu0.1
    • 0.9.2+dfsg-1ubuntu0.2
    • 0.9.2+dfsg-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-httplib2 Ubuntu:20.04:LTS

    Versions
    • 0.11.3-2
    • 0.11.3-2build1
    • 0.14.0-1
    • 0.14.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →