id: PYSEC-2020-46
details: In httplib2 before version 0.18.0, an attacker controlling unescaped part
  of uri for `httplib2.Http.request()` could change request headers and body, send
  additional hidden requests to same server. This vulnerability impacts software that
  uses httplib2 with uri constructed by string concatenation, as opposed to proper
  urllib building with escaping. This has been fixed in 0.18.0.
affected:
- package:
    name: httplib2
    ecosystem: PyPI
    purl: pkg:pypi/httplib2
  ranges:
  - type: GIT
    repo: https://github.com/httplib2/httplib2
    events:
    - introduced: "0"
    - fixed: a1457cc31f3206cf691d11d2bf34e98865873e9e
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.18.0
  versions:
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - "0.8"
  - "0.9"
  - 0.9.1
  - 0.9.2
  - 0.10.3
  - 0.11.0
  - 0.11.1
  - 0.11.3
  - 0.12.0
  - 0.12.1
  - 0.12.3
  - 0.13.0
  - 0.13.1
  - 0.14.0
  - 0.15.0
  - 0.16.0
  - 0.17.0
  - 0.17.1
  - 0.17.2
  - 0.17.3
  - 0.17.4
references:
- type: FIX
  url: https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
- type: ADVISORY
  url: https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
- type: WEB
  url: https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html
- type: WEB
  url: https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E
- type: WEB
  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/
- type: WEB
  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/
- type: WEB
  url: https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E
- type: WEB
  url: https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E
- type: WEB
  url: https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E
- type: WEB
  url: https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E
aliases:
- CVE-2020-11078
- GHSA-gg84-qgv9-w4pq
modified: "2020-08-19T18:56:00Z"
published: "2020-05-20T16:15:00Z"