Published: 20/05/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.8 | Impact Score: 4 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
httplib2 project httplib2
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 8.0

Synopsis Low: resource-agents security and bug fix update Type/Severity Security Advisory: Low Topic An update for resource-agents is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Low: resource-agents security and bug fix update Type/Severity Security Advisory: Low Topic An update for resource-agents is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Low: fence-agents security and bug fix update Type/Severity Security Advisory: Low Topic An update for fence-agents is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base sc ...

A flaw was found in python-httplib2 An attacker controlling an unescaped part of uri for `httplib2Httprequest()` could change request headers and body, send additional hidden requests to same server This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with esca ...

In httplib2 before version 0180, an attacker controlling unescaped part of uri for `httplib2Httprequest()` could change request headers and body, send additional hidden requests to same server This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping ...

CWE-93 https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3E https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3E https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3E https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3E https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3E https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2020:5004 https://alas.aws.amazon.com/AL2/ALASANSIBLE2-2023-007.html

CVE-2020-11078

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect