| Package | python-httplib2 |
|---|---|
| Version | 0.9.2+dfsg-1+deb9u1 (stretch), 0.11.3-2+deb10u1 (buster) |
| Related CVEs | CVE-2020-11078 CVE-2021-21240 CVE-2026-59939 |
Multiple vulnerabilities were discovered in python-httplib2, a comprehensive Python HTTP client library:
CVE-2020-11078
Vulnerability that impacts on software that uses httplib2
with uri constructed by string concatenation, as opposed to proper urllib
building with escaping.
CVE-2021-21240
A malicious server which responds with long series of '\xa0' characters in
the 'www-authenticate' header may cause Denial of Service (CPU burn while
parsing header) of the httplib2 client accessing said server
CVE-2026-59939
Unbounded decompression of HTTP response bodies encoded with gzip or deflate
Content-Encoding could result in denial of service.
For Debian 10 buster, these problems have been fixed in version 0.11.3-2+deb10u1.
For Debian 9 stretch, these problems have been fixed in version 0.9.2+dfsg-1+deb9u1.
We recommend that you upgrade your python-httplib2 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.