CVE-2020-11078
published 2020-05-20CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send…
PriorityP338medium6.8CVSS 3.1
AVNACHPRNUINSCCNIHAN
EPSS
2.59%
83.8th percentile
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python-httplib2 | < python-httplib2 0.18.1-1 (bookworm) | python-httplib2 0.18.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| httplib2 | httplib2 | < 0.81.0 | 0.81.0 |
| httplib2 | httplib2 | >= 0 < 0.18.0 | 0.18.0 |
| httplib2_project | httplib2 | < 0.18.0 | 0.18.0 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
vendor_redhat·2020-05-20·CVSS 6.1
CVE-2020-11078 [MEDIUM] CWE-113 python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenati
Debian
CVE-2020-11078: python-httplib2 - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri...
vendor_debian·2020·CVSS 6.8
CVE-2020-11078 [MEDIUM] CVE-2020-11078: python-httplib2 - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri...
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Scope: local
bookworm: resolved (fixed in 0.18.1-1)
bullseye: resolved (fixed in 0.18.1-1)
forky: resolved (fixed in 0.18.1-1)
sid: resolved (fixed in 0.18.1-1)
trixie: resolved (fixed in 0.18.1-1)
OSV
CVE-2020-11078: In httplib2 before version 0
osv·2020-05-20·CVSS 6.8
CVE-2020-11078 [MEDIUM] CVE-2020-11078: In httplib2 before version 0
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
GHSA
CRLF injection in httplib2
ghsa·2020-05-20
CVE-2020-11078 [MEDIUM] CWE-93 CRLF injection in httplib2
CRLF injection in httplib2
### Impact
Attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.
Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.
### Patches
Problem has been fixed in 0.18.0
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.
### Workarounds
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.
```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "ap
OSV
CRLF injection in httplib2
osv·2020-05-20
CVE-2020-11078 [MEDIUM] CRLF injection in httplib2
CRLF injection in httplib2
### Impact
Attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.
Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.
### Patches
Problem has been fixed in 0.18.0
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.
### Workarounds
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.
```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "ap
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [epel-all]
bugzilla·2020-06-10·CVSS 6.8
CVE-2020-11078 [MEDIUM] CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [epel-all]
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
Bugzilla
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
bugzilla·2020-06-10·CVSS 6.8
CVE-2020-11078 [MEDIUM] CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Reference:
https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
Upstream commit:
https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
Discussion:
Created python-httplib2 tracking bugs for this issue:
Affects: epel-all [bug 18
Bugzilla
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [fedora-all]
bugzilla·2020-06-10·CVSS 6.8
CVE-2020-11078 [MEDIUM] CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [fedora-all]
CVE-2020-11078 python-httplib2: CRLF injection via an attacker controlling unescaped part of uri for httplib2.Http.request function [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg co
https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9ehttps://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pqhttps://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/06/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9ehttps://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pqhttps://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3Ehttps://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/06/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/
2020-05-20
Published