In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-007 advisory.

    A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. (CVE-2020-11078)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5004 advisory.

    - Upgrade bundled python-httplib2 to fix CVE-2020-11078

      Resolves: rhbz#1850992

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has fence-agents packages installed that are affected by a vulnerability:

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has resource-agents packages installed that are affected by a vulnerability:

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1806-1 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

  - httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious     server which responds with long series of \xa0 characters in the www-authenticate header may cause     Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is     fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing     library. (CVE-2021-21240)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2116 advisory.

    A comprehensive HTTP client library that supports many features left out of other HTTP libraries.

    Security Fix(es):

    * CRLF injection via an attacker controlled unescaped part of uri for     httplib2.Http.request function (CVE-2020-11078)

    * Regular expression denial of service via malicious header     (CVE-2021-21240)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python-httplib2 contains the following fixes :

Security fixes included in this update :

  - CVE-2021-21240: Fixed a regular expression denial of     service via malicious header (bsc#1182053).

  - CVE-2020-11078: Fixed an issue where an attacker could     change request headers and body (bsc#1171998).

Non security fixes included in this update :

  - Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

  - update to 0.19.0 :

  - auth: parse headers using pyparsing instead of regexp

  - auth: WSSE token needs to be string not bytes

  - update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  - explicit build-backend workaround for pip build     isolation bug

  - IMPORTANT security vulnerability CWE-93 CRLF injection     Force %xx quote of space, CR, LF characters in uri.

  - Ship test suite in source dist

  - Update to 0.17.1

  - python3: no_proxy was not checked with https

  - feature: Http().redirect_codes set, works after     follow(_all)_redirects check This allows one line     workaround for old gcloud library that uses 308 response     without redirect semantics.

  - IMPORTANT cache invalidation change, fix 307 keep     method, add 308 Redirects

  - proxy: username/password as str compatible with pysocks

  - python2: regression in connect() error handling

  - add support for password protected certificate files

  - feature: Http.close() to clean persistent connections     and sensitive data

  - Update to 0.14.0 :

  - Python3: PROXY_TYPE_SOCKS5 with str user/pass raised     TypeError

  - version update to 0.13.1 0.13.1

  - Python3: Use no_proxy     https://github.com/httplib2/httplib2/pull/140 0.13.0

  - Allow setting TLS max/min versions     https://github.com/httplib2/httplib2/pull/138 0.12.3

  - No changes to library. Distribute py3 wheels. 0.12.1

  - Catch socket timeouts and clear dead connection     https://github.com/httplib2/httplib2/issues/18     https://github.com/httplib2/httplib2/pull/111

  - Officially support Python 3.7 (package metadata)     https://github.com/httplib2/httplib2/issues/123 0.12.0

  - Drop support for Python 3.3

  - ca_certs from environment HTTPLIB2_CA_CERTS or certifi     https://github.com/httplib2/httplib2/pull/117

  - PROXY_TYPE_HTTP with non-empty user/pass raised     TypeError: bytes required     https://github.com/httplib2/httplib2/pull/115

  - Revert http:443->https workaround     https://github.com/httplib2/httplib2/issues/112

  - eliminate connection pool read race     https://github.com/httplib2/httplib2/pull/110

  - cache: stronger safename     https://github.com/httplib2/httplib2/pull/101 0.11.3

  - No changes, just reupload of 0.11.2 after fixing     automatic release conditions in Travis. 0.11.2

  - proxy: py3 NameError basestring     https://github.com/httplib2/httplib2/pull/100 0.11.1

  - Fix HTTP(S)ConnectionWithTimeout AttributeError     proxy_info https://github.com/httplib2/httplib2/pull/97     0.11.0

  - Add DigiCert Global Root G2 serial     033af1e6a711a9a0bb2864b11d09fae5     https://github.com/httplib2/httplib2/pull/91

  - python3 proxy support     https://github.com/httplib2/httplib2/pull/90

  - If no_proxy environment value ends with comma then proxy     is not used     https://github.com/httplib2/httplib2/issues/11

  - fix UnicodeDecodeError using socks5 proxy     https://github.com/httplib2/httplib2/pull/64

  - Respect NO_PROXY env var in proxy_info_from_url     https://github.com/httplib2/httplib2/pull/58

  - NO_PROXY=bar was matching foobar (suffix without dot     delimiter) New behavior matches curl/wget :

  - no_proxy=foo.bar will only skip proxy for exact hostname     match

  - no_proxy=.wild.card will skip proxy for     any.subdomains.wild.card     https://github.com/httplib2/httplib2/issues/94

  - Bugfix for Content-Encoding: deflate     https://stackoverflow.com/a/22311297

  - deleted patches

  - Removing certifi patch: httplib2 started to use certifi     and this is already bent to use system certificate     bundle by another patch

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has resource-agents packages installed that are affected by a vulnerability:

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has fence-agents packages installed that are affected by a vulnerability:

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4605 advisory.

  - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request     function (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5004 advisory.

  - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request     function (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory.

  - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request     function (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5947 advisory.

    - Upgrade bundled python-httplib2 to fix CVE-2020-11078

      Resolves: rhbz#1850990

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5004 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5003 advisory.

    - Upgrade bundled python-httplib2 to fix CVE-2020-11078       Resolves: rhbz#1850114

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5004 advisory.

    The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts.
    These scripts interface with several services to allow operating in a high-availability (HA) environment.

    Security Fix(es):

    * python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for     httplib2.Http.request function (CVE-2020-11078)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * gcp-vpc-move-vip: An existing alias IP range is removed when a second alias IP range is added     (BZ#1846732)

    * sybaseASE: Resource fails to complete a probe operation without access to $sybase_home [RHEL 7]     (BZ#1848673)

    * azure-lb: Resource fails intermittently due to nc output redirection to pidfile (BZ#1850779)

    * azure-events: handle exceptions in urlopen (RHEL7) (BZ#1862121)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for     httplib2.Http.request function (CVE-2020-11078)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * fence_lpar: Long username, HMC hostname, or managed system name causes failures [RHEL 7] (BZ#1860545)

    * InstanceHA does not evacuate instances created with private flavor in tenant project (RHEL7)     (BZ#1862024)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4605 advisory.

    The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts.
    These scripts interface with several services to allow operating in a high-availability (HA) environment.

    Security Fix(es):

    * python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for     httplib2.Http.request function (CVE-2020-11078)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1420 advisory.

    In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix for CVE-2020-11078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In httplib2, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.

For Debian 8 'Jessie', this problem has been fixed in version 0.9+dfsg-2+deb8u1.

We recommend that you upgrade your python-httplib2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
182008	Amazon Linux 2 : python-httplib2 (ALASANSIBLE2-2023-007)	Nessus	Amazon Linux Local Security Checks	medium
180890	Oracle Linux 7 : resource-agents (ELSA-2020-5004)	Nessus	Oracle Linux Local Security Checks	medium
154628	NewStart CGSL CORE 5.05 / MAIN 5.05 : fence-agents Vulnerability (NS-SA-2021-0146)	Nessus	NewStart CGSL Local Security Checks	medium
154494	NewStart CGSL CORE 5.05 / MAIN 5.05 : resource-agents Vulnerability (NS-SA-2021-0155)	Nessus	NewStart CGSL Local Security Checks	medium
151722	openSUSE 15 Security Update : python-httplib2 (openSUSE-SU-2021:1806-1)	Nessus	SuSE Local Security Checks	medium
149997	RHEL 8 : Red Hat OpenStack Platform 16.1.6 (python-httplib2) (RHSA-2021:2116)	Nessus	Red Hat Local Security Checks	medium
149881	openSUSE Security Update : python-httplib2 (openSUSE-2021-772)	Nessus	SuSE Local Security Checks	medium
149338	NewStart CGSL CORE 5.04 / MAIN 5.04 : resource-agents Vulnerability (NS-SA-2021-0034)	Nessus	NewStart CGSL Local Security Checks	medium
147350	NewStart CGSL CORE 5.04 / MAIN 5.04 : fence-agents Vulnerability (NS-SA-2021-0028)	Nessus	NewStart CGSL Local Security Checks	medium
145820	CentOS 8 : resource-agents (CESA-2020:4605)	Nessus	CentOS Local Security Checks	medium
144431	Virtuozzo 7 : resource-agents / resource-agents-aliyun / etc (VZLSA-2020-5004)	Nessus	Virtuozzo Local Security Checks	medium
144430	Virtuozzo 7 : fence-agents-aliyun / fence-agents-all / etc (VZLSA-2020-5003)	Nessus	Virtuozzo Local Security Checks	medium
143207	Oracle Linux 8 : resource-agents (ELSA-2020-5947)	Nessus	Oracle Linux Local Security Checks	medium
143122	CentOS 7 : fence-agents (RHSA-2020:5003)	Nessus	CentOS Local Security Checks	medium
143052	CentOS 7 : resource-agents (RHSA-2020:5004)	Nessus	CentOS Local Security Checks	medium
142790	Oracle Linux 7 : fence-agents (ELSA-2020-5003)	Nessus	Oracle Linux Local Security Checks	medium
142707	RHEL 7 : resource-agents (RHSA-2020:5004)	Nessus	Red Hat Local Security Checks	medium
142704	RHEL 7 : fence-agents (RHSA-2020:5003)	Nessus	Red Hat Local Security Checks	medium
142441	RHEL 8 : resource-agents (RHSA-2020:4605)	Nessus	Red Hat Local Security Checks	medium
140095	Amazon Linux AMI : python-httplib2 (ALAS-2020-1420)	Nessus	Amazon Linux Local Security Checks	medium
137733	Fedora 31 : python-httplib2 (2020-37779a5c93)	Nessus	Fedora Local Security Checks	medium
137428	Fedora 32 : python-httplib2 (2020-a7a15a9687)	Nessus	Fedora Local Security Checks	medium
137008	Debian DLA-2232-1 : python-httplib2 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-11078

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium