Most recent entries from all

bdu:2022-00801

BREW-duplicity-CVE-2021-21240 — Regular Expression Denial of Service (REDoS) in httplib2

Affected: Homebrew: duplicity

### Impact A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

### Workarounds ```py import httplib2 httplib2.USE_WWW_AUTH_STRICT_PARSING = True ```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces): repeat = "\xa0" * n_spaces return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler): def do_GET(self): self…

certfr-2026-avi-0316 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0316

EUVD-2026-22045

fkie_cve-2021-21240

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

GHSA-93xj-8mrv-444m — Regular Expression Denial of Service (REDoS) in httplib2

Affected: PyPI: httplib2

### Patches Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

### Workarounds ```py import httplib2 httplib2.USE_WWW_AUTH_STRICT_PARSING = True ```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces): repeat = "\xa0" * n_spaces return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler): def do_GET(self): self…

gsd-2021-21240

OESA-2021-1126 — python-httplib2 security update

Affected: openEuler:20.03-LTS: python-httplib2, openEuler:20.03-LTS-SP1: python-httplib2

httplib2 is a comprehensive HTTP client library, httplib2.py supports many features left out of other HTTP libraries. Security Fix(es): httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.(CVE-2021-21240)

openSUSE-SU-2021:0772-1 — Security update for python-httplib2

Security update for python-httplib2

PYSEC-2021-16

Affected: PyPI: httplib2

RHSA-2021:2116 — Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update

python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function python-httplib2: Regular expression denial of service via malicious header

SUSE-SU-2021:1637-1 — Security update for python-httplib2

Security update for python-httplib2

UBUNTU-CVE-2021-21240

Affected: Ubuntu:14.04:LTS: python-httplib2, Ubuntu:16.04:LTS: python-httplib2, Ubuntu:18.04:LTS: python-httplib2, Ubuntu:20.04:LTS: python-httplib2, Ubuntu:22.04:LTS: python-httplib2