In httplib2 prima della versione 0.18.0, un attaccante che controlla parte senza caratteri di escape uri per `httplib2.Http.request ()` potrebbe cambiare intestazioni di richiesta e il corpo, inviare richieste aggiuntivi nascosti al server stesso. Questo software impatti vulnerabilità che utilizza httplib2 con uri costruiti concatenazione di stringhe, al contrario di una corretta costruzione urllib con la fuga. Questo è stato risolto in 0.18.0.
https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/
https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E
https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11078
