CVE-2021-21240
High
Description
httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHttplib2
PublishedFeb 8, 2021
First seenFeb 8, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- httplib2_project httplib20.19.0 or later
- httplib20.19.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| httplib2_project httplib2 | v < 0.19.0 | 0.19.0 |
| httplib2PyPI | v < 0.19.0 | 0.19.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.