This update for python-httplib2 contains the following fixes:
Security fixes included in this update:
- CVE-2021-21240: Fixed a regular expression denial of service via
malicious header (bsc#1182053).
- CVE-2020-11078: Fixed an issue where an attacker could change request
headers and body (bsc#1171998).
Non security fixes included in this update:
- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)
- update to 0.19.0:
* auth: parse headers using pyparsing instead of regexp
* auth: WSSE token needs to be string not bytes
- update to 0.18.1: (bsc#1171998, CVE-2020-11078)
* explicit build-backend workaround for pip build isolation bug
* IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote
of space, CR, LF characters in uri.
* Ship test suite in source dist
- Update to 0.17.1
* python3: no_proxy was not checked with https
* feature: Http().redirect_codes set, works after...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP2:
zypper in -t patch openSUSE-2021-796=1
- openSUSE Backports SLE-15-SP2 (noarch):
python2-httplib2-0.19.0-bp152.3.3.1
https://www.suse.com/security/cve/CVE-2020-11078.html
https://www.suse.com/security/cve/CVE-2021-21240.html
https://bugzilla.suse.com/1171998
https://bugzilla.suse.com/1182053
Get the latest Linux and open source security news straight to your inbox.