CVE-2021-21240
Summary
| CVE | CVE-2021-21240 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-02-08 20:15:00 UTC |
|---|
| Updated | 2021-02-12 14:56:00 UTC |
|---|
| Description | httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| parse auth headers using pyparsing instead of regexp · httplib2/httplib2@bd9ee25 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Regular Expression Denial of Service (REDoS) in httplib2 · Advisory · httplib2/httplib2 · GitHub |
CONFIRM |
github.com |
Exploit, Mitigation, Third Party Advisory |
| parse auth headers using pyparsing instead of regexp by temoto · Pull Request #182 · httplib2/httplib2 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| httplib2 · PyPI |
MISC |
pypi.org |
Product, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 183347 Debian Security Update for python-httplib2 (CVE-2021-21240)
- 501902 Alpine Linux Security Update for py3-httplib2
- 750016 SUSE Enterprise Linux Security Update for python-httplib2 (SUSE-SU-2021:1637-1)
- 750086 SUSE Enterprise Linux Security Update for python-httplib2 (SUSE-SU-2021:1806-1)
- 750087 SUSE Enterprise Linux Security Update for python-httplib2 (SUSE-SU-2021:1807-1)
- 750195 OpenSUSE Security Update for python-httplib2 (openSUSE-SU-2021:0772-1)
- 750764 OpenSUSE Security Update for python-httplib2 (openSUSE-SU-2021:1806-1)
- 982955 Python (pip) Security Update for httplib2 (GHSA-93xj-8mrv-444m)
