Affected: Homebrew: duplicity

### Impact A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

### Workarounds ```py import httplib2 httplib2.USE_WWW_AUTH_STRICT_PARSING = True ```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces): repeat = "\xa0" * n_spaces return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler): def do_GET(self): self…

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

Affected: PyPI: httplib2

### Impact A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

### Workarounds ```py import httplib2 httplib2.USE_WWW_AUTH_STRICT_PARSING = True ```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces): repeat = "\xa0" * n_spaces return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler): def do_GET(self): self…

Affected: openEuler:20.03-LTS: python-httplib2, openEuler:20.03-LTS-SP1: python-httplib2

httplib2 is a comprehensive HTTP client library, httplib2.py supports many features left out of other HTTP libraries. Security Fix(es): httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.(CVE-2021-21240)

Security update for python-httplib2

Affected: PyPI: httplib2

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function python-httplib2: Regular expression denial of service via malicious header

Security update for python-httplib2

Affected: Ubuntu:14.04:LTS: python-httplib2, Ubuntu:16.04:LTS: python-httplib2, Ubuntu:18.04:LTS: python-httplib2, Ubuntu:20.04:LTS: python-httplib2, Ubuntu:22.04:LTS: python-httplib2

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.