Critical Header Manipulation Vulnerability in python-httplib2
Summary
CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. Affects python-httplib2 across 2 version ranges.
< 0.18.1-1
< a1457cc31f3206cf691d11d2bf34e98865873e9e
Fixed in 0.18.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-httplib2 is a widely used HTTP client library for Python that simplifies the process of making HTTP requests. It is designed to be easy to use and provides a variety of features, including support for caching, OAuth, and more. However, prior to version 0.18.0, it was vulnerable to a critical issue where an attacker could manipulate request headers and body by controlling unescaped parts of the URI, particularly if the URI was constructed using string concatenation instead of proper URL escaping.
Vulnerability Detail
The vulnerability, identified as CVE-2020-11078, arises from improper handling of URIs in the httplib2 library. An attacker could exploit this flaw by crafting a malicious URI that, when passed to the httplib2.Http.request() method, could alter the request headers and body. This could lead to unauthorized requests being sent to the server, potentially exposing sensitive information or causing unintended actions. The vulnerability is particularly severe for applications that do not properly escape URIs, making them susceptible to injection attacks.
How To Fix
Minimum fixed version
0.18.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-httplib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to ensure that all URIs passed to httplib2.Http.request() are properly escaped. This can be done using Python's urllib.parse.quote() function. For example:
import urllib.parse uri = 'http://example.com/api?param=' + urllib.parse.quote(user_input) response = httplib2.Http().request(uri, method='GET')
Conclusion
The CVE-2020-11078 vulnerability in python-httplib2 poses a significant risk to applications that improperly handle URIs. It is crucial for developers to upgrade to version 0.18.1 or later to mitigate this risk. Additionally, using proper URI escaping techniques can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for python-httplib2 →
FAQ
CVE-2020-11078 is a vulnerability in the python-httplib2 library that allows an attacker to manipulate request headers and body by controlling unescaped parts of the URI.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-11078 is 6.8, indicating a medium severity level.
If you cannot upgrade immediately, ensure that all URIs passed to httplib2.Http.request() are properly escaped using Python's urllib.parse.quote() function.
Versions of python-httplib2 prior to 0.18.1 are affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python-httplib2.
