Critical Vulnerability in python-httplib2: Unescaped URI Manipulation
Summary
UBUNTU-CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. Affects python-httplib2 versions 0.8-2 – 0.8-2build1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-httplib2 is a widely used HTTP client library for Python that simplifies the process of making HTTP requests. It is designed to be easy to use and integrates well with various web services. However, certain versions of this library are vulnerable to a security flaw that allows attackers to manipulate request headers and body through unescaped URI components, potentially leading to unauthorized actions.
Vulnerability Detail
In httplib2 versions prior to 0.18.0, an attacker could exploit the library by controlling unescaped parts of the URI in the httplib2.Http.request() method. This vulnerability allows the attacker to alter request headers and body, and send additional hidden requests to the same server. The issue arises when software uses string concatenation to construct URIs instead of utilizing proper URI building methods that ensure escaping. The potential ramifications include unauthorized data access and manipulation, making this a significant security concern.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that any URIs constructed for requests are properly escaped. This can be done using the urllib.parse module in Python. For example:
from urllib.parse import quote
uri = 'http://example.com/api/resource?param=' + quote(user_input) response = httplib2.Http().request(uri)
Conclusion
The vulnerability in python-httplib2 allows attackers to manipulate HTTP requests through unescaped URI components, posing a significant security risk. It is crucial for users of this library to update to the patched version to mitigate potential threats.
See every vulnerability recorded for python-httplib2 →
FAQ
Versions prior to 0.18.0 of python-httplib2 are affected by this vulnerability.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
The vulnerability can lead to unauthorized access and manipulation of data, as attackers can alter request headers and body.
Yes, the vulnerability has been patched in version 0.18.0 of python-httplib2. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-httplib2.
