Log in Start free

Vulnerability · Published Feb 8, 2021 · Assigned by GitHub_M

CVE-2021-21240Regular Expression Denial of Service in httplib2

High 7.5

In plain English

A high-severity uncontrolled resource consumption in httplib2 from httplib2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.7%top 10.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-httplib20.19.0-r0ALPINE-CVE-2021-21240
Alpine:v3.21py3-httplib20.19.0-r0ALPINE-CVE-2021-21240
Alpine:v3.22py3-httplib20.19.0-r0ALPINE-CVE-2021-21240
Alpine:v3.23py3-httplib20.19.0-r0ALPINE-CVE-2021-21240
Alpine:v3.24py3-httplib20.19.0-r0ALPINE-CVE-2021-21240
Debian:12python-httplib20.20.2-1DEBIAN-CVE-2021-21240
Debian:13python-httplib20.20.2-1DEBIAN-CVE-2021-21240
Debian:14python-httplib20.20.2-1DEBIAN-CVE-2021-21240
PyPIhttplib20.19.0GHSA-93xj-8mrv-444m
PyPIhttplib20.19.0PYSEC-2021-16
Ubuntu:22.04:LTSpython-httplib2no fix listedUBUNTU-CVE-2021-21240

Affected products (as reported)

VendorProductVersions
httplib2 httplib2 < 0.19.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References