ArchLinux: 202102-35: python-httplib2: denial of service
Summary
In python-httplib2 before version 0.19.0, a malicious server which responds with a long series of "\xa0" characters in the "www- authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.
Resolution
Upgrade to 0.19.0-1.
# pacman -Syu "python-httplib2>=0.19.0-1"
The problem has been fixed upstream in version 0.19.0.
References
https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m https://github.com/httplib2/httplib2/pull/182 https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc https://security.archlinux.org/CVE-2021-21240
Workaround
The issue can be mitigated by using"httplib2.USE_WWW_AUTH_STRICT_PARSING = True".