Skip to content

Product

debian/python-httplib2 vulnerabilities

3 published CVES affecting debian/python-httplib2, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
1
Unscored
0
CISA KEV
0

Latest debian/python-httplib2 CVEs

Newest publication first

  1. CVE-2020-11078 CRLF injection in httplib2

    Published
    MediumCVSS 6.8

    In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by strin...

  2. CVE-2013-2037 httplib2 incorrectly checks SSL certificate

    Published
    LowCVSS 2.6

    httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

  3. CVE-2021-21240 Regular Expression Denial of Service (REDoS) in httplib2

    HighCVSS 7.7

    Impact A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. Patches Version 0.19.0 contains new implementation of auth headers...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.