CVE-2020-11078: CRLF injection in httplib2
(updated )
Attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server.
Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.
References
- github.com/advisories/GHSA-gg84-qgv9-w4pq
- github.com/httplib2/httplib2
- github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
- github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
- github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2020-46.yaml
- lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E
- lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E
- lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E
- lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E
- lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E
- lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E
- lists.debian.org/debian-lts-announce/2020/06/msg00000.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI
- nvd.nist.gov/vuln/detail/CVE-2020-11078
Code Behaviors & Features
Detect and mitigate CVE-2020-11078 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →