CVE-2021-21240: Regular Expression Denial of Service (REDoS) in httplib2
(updated )
A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.
References
- github.com/advisories/GHSA-93xj-8mrv-444m
- github.com/httplib2/httplib2
- github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc
- github.com/httplib2/httplib2/pull/182
- github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m
- github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2021-16.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-21240
- pypi.org/project/httplib2
Code Behaviors & Features
Detect and mitigate CVE-2021-21240 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →