You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
CVE-2020-11078 - Medium Severity Vulnerability
Vulnerable Library - httplib2-0.13.0.tar.gz
A comprehensive HTTP client library.
Library home page: https://files.pythonhosted.org/packages/5c/f3/7206894743389a4f727b73e6df4da60c9ee3cbef3f5afd82814592eafa8b/httplib2-0.13.0.tar.gz
Path to dependency file: skf-flask
Path to vulnerable library: skf-flask,skf-flask,skf-flask/requirements.txt,skf-flask/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 14dd4dd6e96053b5864e9993ab2386eb98ff67f6
Vulnerability Details
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for
httplib2.Http.request()
could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.Publish Date: 2020-05-20
URL: CVE-2020-11078
CVSS 3 Score Details (6.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-gg84-qgv9-w4pq
Release Date: 2020-05-20
Fix Resolution: v0.18.0
The text was updated successfully, but these errors were encountered: