Denial of Service Vulnerability in Python httplib2 Package
Summary
DEBIAN-CVE-2021-21240: httplib2 is a comprehensive HTTP client library for Python. Affects python-httplib2 versions < 0.20.2-1. Fixed in 0.20.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httplib2 package is a comprehensive HTTP client library for Python that facilitates communication with web services. It supports various features such as caching, authentication, and redirects, making it a popular choice for developers. However, prior to version 0.19.0, the package was susceptible to a Denial of Service (DoS) vulnerability due to improper handling of specific server responses.
Vulnerability Detail
In httplib2 versions before 0.19.0, a malicious server could exploit the library by sending a long series of '\xa0' characters in the 'www-authenticate' header. This would lead to excessive CPU usage while the httplib2 client attempts to parse the header, resulting in a Denial of Service condition. The vulnerability stems from the library's inadequate implementation of authentication header parsing, which has been addressed in later versions.
How To Fix
Minimum fixed version
0.20.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-httplib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing a firewall rule to block requests from untrusted sources or limit the exposure of your application to potentially malicious servers.
Conclusion
The Denial of Service vulnerability in the httplib2 package poses a significant risk to applications using versions prior to 0.19.0. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing temporary workarounds can help protect your application until an update can be performed.
See every vulnerability recorded for python-httplib2 →
FAQ
The vulnerability allows a malicious server to cause excessive CPU usage in the httplib2 client, leading to a Denial of Service.
Versions prior to 0.19.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
Consider implementing firewall rules to block requests from untrusted servers as a temporary measure.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-21240.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-httplib2.
