httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017469 advisory.

    httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious     server which responds with long series of \xa0 characters in the www-authenticate header may cause     Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is     fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing     library.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious     server which responds with long series of \xa0 characters in the www-authenticate header may cause     Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is     fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing     library. (CVE-2021-21240)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious
    server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause
    Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is
    fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing
    library. (CVE-2021-21240)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1806-1 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

  - httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious     server which responds with long series of \xa0 characters in the www-authenticate header may cause     Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is     fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing     library. (CVE-2021-21240)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2116 advisory.

    A comprehensive HTTP client library that supports many features left out of other HTTP libraries.

    Security Fix(es):

    * CRLF injection via an attacker controlled unescaped part of uri for     httplib2.Http.request function (CVE-2020-11078)

    * Regular expression denial of service via malicious header     (CVE-2021-21240)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python-httplib2 contains the following fixes :

Security fixes included in this update :

  - CVE-2021-21240: Fixed a regular expression denial of     service via malicious header (bsc#1182053).

  - CVE-2020-11078: Fixed an issue where an attacker could     change request headers and body (bsc#1171998).

Non security fixes included in this update :

  - Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

  - update to 0.19.0 :

  - auth: parse headers using pyparsing instead of regexp

  - auth: WSSE token needs to be string not bytes

  - update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  - explicit build-backend workaround for pip build     isolation bug

  - IMPORTANT security vulnerability CWE-93 CRLF injection     Force %xx quote of space, CR, LF characters in uri.

  - Ship test suite in source dist

  - Update to 0.17.1

  - python3: no_proxy was not checked with https

  - feature: Http().redirect_codes set, works after     follow(_all)_redirects check This allows one line     workaround for old gcloud library that uses 308 response     without redirect semantics.

  - IMPORTANT cache invalidation change, fix 307 keep     method, add 308 Redirects

  - proxy: username/password as str compatible with pysocks

  - python2: regression in connect() error handling

  - add support for password protected certificate files

  - feature: Http.close() to clean persistent connections     and sensitive data

  - Update to 0.14.0 :

  - Python3: PROXY_TYPE_SOCKS5 with str user/pass raised     TypeError

  - version update to 0.13.1 0.13.1

  - Python3: Use no_proxy     https://github.com/httplib2/httplib2/pull/140 0.13.0

  - Allow setting TLS max/min versions     https://github.com/httplib2/httplib2/pull/138 0.12.3

  - No changes to library. Distribute py3 wheels. 0.12.1

  - Catch socket timeouts and clear dead connection     https://github.com/httplib2/httplib2/issues/18     https://github.com/httplib2/httplib2/pull/111

  - Officially support Python 3.7 (package metadata)     https://github.com/httplib2/httplib2/issues/123 0.12.0

  - Drop support for Python 3.3

  - ca_certs from environment HTTPLIB2_CA_CERTS or certifi     https://github.com/httplib2/httplib2/pull/117

  - PROXY_TYPE_HTTP with non-empty user/pass raised     TypeError: bytes required     https://github.com/httplib2/httplib2/pull/115

  - Revert http:443->https workaround     https://github.com/httplib2/httplib2/issues/112

  - eliminate connection pool read race     https://github.com/httplib2/httplib2/pull/110

  - cache: stronger safename     https://github.com/httplib2/httplib2/pull/101 0.11.3

  - No changes, just reupload of 0.11.2 after fixing     automatic release conditions in Travis. 0.11.2

  - proxy: py3 NameError basestring     https://github.com/httplib2/httplib2/pull/100 0.11.1

  - Fix HTTP(S)ConnectionWithTimeout AttributeError     proxy_info https://github.com/httplib2/httplib2/pull/97     0.11.0

  - Add DigiCert Global Root G2 serial     033af1e6a711a9a0bb2864b11d09fae5     https://github.com/httplib2/httplib2/pull/91

  - python3 proxy support     https://github.com/httplib2/httplib2/pull/90

  - If no_proxy environment value ends with comma then proxy     is not used     https://github.com/httplib2/httplib2/issues/11

  - fix UnicodeDecodeError using socks5 proxy     https://github.com/httplib2/httplib2/pull/64

  - Respect NO_PROXY env var in proxy_info_from_url     https://github.com/httplib2/httplib2/pull/58

  - NO_PROXY=bar was matching foobar (suffix without dot     delimiter) New behavior matches curl/wget :

  - no_proxy=foo.bar will only skip proxy for exact hostname     match

  - no_proxy=.wild.card will skip proxy for     any.subdomains.wild.card     https://github.com/httplib2/httplib2/issues/94

  - Bugfix for Content-Encoding: deflate     https://stackoverflow.com/a/22311297

  - deleted patches

  - Removing certifi patch: httplib2 started to use certifi     and this is already bent to use system certificate     bundle by another patch

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
313939	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-httplib2 (UTSA-2026-017469)	Nessus	Unity Linux Local Security Checks	high
223633	Linux Distros Unpatched Vulnerability : CVE-2021-21240	Nessus	Misc.	high
413009	SCA: security update for httplib2 (GHSA-93xj-8mrv-444m)	Tenable Cloud Security	SCA Checks	high
413009	SCA: security update for httplib2 (GHSA-93xj-8mrv-444m)	Tenable Self-Hosted Container Security	SCA Checks	high
406669	Alpine: multiple py3-httplib2 packages: security update to 0.19.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406669	Alpine: multiple py3-httplib2 packages: security update to 0.19.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
151722	openSUSE 15 Security Update : python-httplib2 (openSUSE-SU-2021:1806-1)	Nessus	SuSE Local Security Checks	medium
149997	RHEL 8 : Red Hat OpenStack Platform 16.1.6 (python-httplib2) (RHSA-2021:2116)	Nessus	Red Hat Local Security Checks	medium
149881	openSUSE Security Update : python-httplib2 (openSUSE-2021-772)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-21240

high

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium