Vulnerabilities > CVE-2021-21240 - Unspecified vulnerability in Httplib2 Project Httplib2

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

httplib2-project

NVD

Published: 2021-02-08

Updated: 2024-11-21

Summary

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

Vulnerable Configurations

Part	Description	Count
Application	Httplib2_Project Httplib2 Project Httplib2 0.9 Httplib2 Project Httplib2 0.9.1 Httplib2 Project Httplib2 0.9.2 Httplib2 Project Httplib2 0.10.1 Httplib2 Project Httplib2 0.10.2 Httplib2 Project Httplib2 0.10.3 Httplib2 Project Httplib2 0.11.0 Httplib2 Project Httplib2 0.11.1 Httplib2 Project Httplib2 0.11.2 Httplib2 Project Httplib2 0.11.3 Httplib2 Project Httplib2 0.12.0 Httplib2 Project Httplib2 0.12.1 Httplib2 Project Httplib2 0.12.3 Httplib2 Project Httplib2 0.13.0 Httplib2 Project Httplib2 0.13.1 Httplib2 Project Httplib2 0.14.0 Httplib2 Project Httplib2 0.15.0 Httplib2 Project Httplib2 0.16.0 Httplib2 Project Httplib2 0.17.0 Httplib2 Project Httplib2 0.17.1 Httplib2 Project Httplib2 0.17.2 Httplib2 Project Httplib2 0.17.3 Httplib2 Project Httplib2 0.17.4 Httplib2 Project Httplib2 0.18.0 Httplib2 Project Httplib2 0.18.1	25

Summary

Vulnerable Configurations

References