QID 983131
QID 983131: Python (pip) Security Update for httplib2 (GHSA-gg84-qgv9-w4pq)
Security update has been released for httplib2 to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.
Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.
Solution
Problem has been fixed in 0.18.0
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.Workaround:
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.
```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "api.server", "/v1", urllib.parse.urlencode({"q": user_input}), ""))
http.request(uri)
```
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.Workaround:
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.
```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "api.server", "/v1", urllib.parse.urlencode({"q": user_input}), ""))
http.request(uri)
```
Vendor References
- GHSA-gg84-qgv9-w4pq -
github.com/advisories/GHSA-gg84-qgv9-w4pq
CVEs related to QID 983131
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-gg84-qgv9-w4pq | httplib2 |
github.com/advisories/GHSA-gg84-qgv9-w4pq |