Show vulnerabilities with patch / with exploit

CRLF injection in httplib2 library for Python



Published: 2020-05-26
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2020-11078
CWE ID CWE-93
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
httplib2
Other software / Other software solutions

Vendor httplib2

Security Advisory

This security advisory describes one low risk vulnerability.

1) CRLF injection

Severity: Low

CVSSv3: 3.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11078

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform CRLF injection attacks.

The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker controlling unescaped part of uri for "httplib2.Http.request()" can change request headers and body, send additional hidden requests to same server.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

httplib2: 0.9, 0.9.1, 0.9.2, 0.10.1, 0.10.2, 0.10.3, 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.12.0, 0.12.1, 0.12.3, 0.13.0, 0.13.1, 0.14.0, 0.15.0, 0.16.0, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4

CPE External links

https://github.com/
httplib2/
httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
https://github.com/
httplib2/
httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.