{"id":"CVE-2020-11078","aliases":["AZL-109469","DEBIAN-CVE-2020-11078","DLA-2232-1","EUVD-2020-0085","GHSA-gg84-qgv9-w4pq","MGASA-2020-0269","PYSEC-2020-46","RHSA-2020:4605","RHSA-2020:5003","RHSA-2020:5004","RHSA-2021:2116","SUSE-SU-2021:1637-1","SUSE-SU-2021:1779-1","SUSE-SU-2021:1806-1","SUSE-SU-2021:1807-1","SUSE-SU-2021:1808-1","UBUNTU-CVE-2020-11078","openSUSE-SU-2021:0772-1","openSUSE-SU-2021:0796-1","openSUSE-SU-2021:1806-1","openSUSE-SU-2024:11231-1","openSUSE-SU-2024:14141-1","openSUSE-SU-2026:11203-1"],"status":"published","title":"CRLF injection in httplib2","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02427,"percentile":0.84331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-93"],"published":"2020-05-20T15:55:47Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"httplib2","fixed_in":["0.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-httplib2","fixed_in":["0.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-httplib2","fixed_in":["0.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-httplib2","fixed_in":["0.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"python-httplib2","fixed_in":["0.9+dfsg-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-httplib2","fixed_in":["0.18.0-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-aliyun","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-aliyun-debuginfo","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-debuginfo","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-debugsource","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-gcp","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-aliyun","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-aliyun-debuginfo","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-debuginfo","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-debugsource","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-gcp","fixed_in":["0:4.1.1-68.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-debuginfo","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-lpar","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-virsh","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-all","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-amt-ws","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-apc","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-apc-snmp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-bladecenter","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-brocade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-cisco-mds","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-cisco-ucs","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-common","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-compute","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-debuginfo","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-drac5","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-eaton-snmp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-emerson","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-eps","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-heuristics-ping","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-hpblade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ibmblade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ifmib","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-moonshot","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-mp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-ssh","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo2","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-intelmodular","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ipdu","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ipmilan","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-kdump","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-lpar","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-mpath","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-redfish","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rhevm","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rsa","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rsb","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-sbd","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-scsi","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-vmware-rest","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-vmware-soap","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-wti","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-zvm","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-aliyun","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-aws","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-azure-arm","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-gce","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-virsh","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-all","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-amt-ws","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-apc","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-apc-snmp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-bladecenter","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-brocade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-cisco-mds","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-cisco-ucs","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-common","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-compute","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-debuginfo","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-drac5","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-eaton-snmp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-emerson","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-eps","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-heuristics-ping","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-hpblade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ibmblade","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ifmib","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-moonshot","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-mp","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-ssh","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo2","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-intelmodular","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ipdu","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ipmilan","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-kdump","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-mpath","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-redfish","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rhevm","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rsa","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rsb","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-sbd","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-scsi","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-vmware-rest","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-vmware-soap","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-wti","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-lpar","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-virsh","fixed_in":["0:4.2.1-41.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-aliyun","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-debuginfo","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-gcp","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents-debuginfo","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents-sap","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap:7","package":"sap-cluster-connector","fixed_in":["0:3.0.1-37.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-debuginfo","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-sap-hana","fixed_in":["0:4.1.1-61.el7_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-sap-hana-scaleout","fixed_in":["0:0.164.0-6.el7_9.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.20.3-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9+dfsg-2+deb8u1"}]}],"versions":["0.9+dfsg-2"]},{"source":"osv","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0"}]}],"versions":["0.10.3","0.11.0","0.11.1","0.11.3","0.12.0","0.12.1","0.12.3","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8","0.9","0.9.1","0.9.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"a1457cc31f3206cf691d11d2bf34e98865873e9e"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0"}]}],"versions":["0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8","0.9","0.9.1","0.9.2","0.10.3","0.11.0","0.11.1","0.11.3","0.12.0","0.12.1","0.12.3","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-aliyun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"resource-agents-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-aliyun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"resource-agents-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-68.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-lpar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fence-agents-virsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-amt-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-apc-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-bladecenter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-brocade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-cisco-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-cisco-ucs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-drac5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-eaton-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-emerson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-eps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-heuristics-ping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-hpblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ibmblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ifmib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-moonshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ilo2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-intelmodular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ipdu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-ipmilan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-lpar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-mpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-redfish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-rsb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-sbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-scsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-vmware-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-vmware-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-wti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-zvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-azure-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fence-agents-virsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-amt-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-apc-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-bladecenter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-brocade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-cisco-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-cisco-ucs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-drac5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-eaton-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-emerson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-eps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-heuristics-ping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-hpblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ibmblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ifmib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-moonshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ilo2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-intelmodular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ipdu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-ipmilan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-mpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-redfish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-rsb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-sbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-scsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-vmware-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-vmware-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-wti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-lpar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fence-agents-virsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-41.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resource-agents-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:7","package":"resource-agents-sap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap:7","package":"sap-cluster-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-sap-hana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1-61.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_sap_hana:7","package":"resource-agents-sap-hana-scaleout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.164.0-6.el7_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-8.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-8.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8-2","0.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9+dfsg-2","0.9.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2+dfsg-1","0.9.2+dfsg-1ubuntu0.1","0.9.2+dfsg-1ubuntu0.2","0.9.2+dfsg-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3-2","0.11.3-2build1","0.14.0-1","0.14.0-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-lp152.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-bp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.1-1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-4.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"httplib2","product":"httplib2"},{"vendor":"httplib2_project","product":"httplib2"}],"references":[{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","advisory","article","report"]},{"url":"https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11078","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2020-46.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gg84-qgv9-w4pq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11078","tags":["advisory"]},{"url":"https://github.com/httplib2/httplib2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0269.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26750","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2232","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4605","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1817432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1817598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1820523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850778","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4605.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11078","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5003","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862024","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5003.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5004","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5004.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2116","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926885","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2116.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21240","tags":["advisory"]},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211637-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171998","tags":["report"]},{"url":"https://bugzilla.suse.com/1182053","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21240","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211779-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211806-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211807-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211808-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-11078","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ANZIEBB4AJVGYC2KYDE7RDSTFBBTL5ID/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BX6XMG6VSE6RQ4LZXDDXUYZZZ2FYOQM7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DTGWJY2VML3YAAFAOOYJAQP5SZ4X6XWG/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-11078","title":"CRLF injection in httplib2","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:00:16Z","modified":"2024-08-04T11:21:14.627Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-0085","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:00:16Z","modified":"2024-08-04T11:21:14Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:07:48.471313Z"}],"ghsa":[{"id":"GHSA-gg84-qgv9-w4pq","title":"CRLF injection in httplib2","description":"### Impact\nAttacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.\n\nImpacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.\n\n### Patches\nProblem has been fixed in 0.18.0\nSpace, CR, LF characters are now quoted before any use.\nThis solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.\n\n### Workarounds\nCreate URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.\n\n```diff\nuser_input = \" HTTP/1.1\\r\\ninjected: attack\\r\\nignore-http:\"\n-uri = \"https://api.server/?q={}\".format(user_input)\n+uri = urllib.parse.urlunsplit((\"https\", \"api.server\", \"/v1\", urllib.parse.urlencode({\"q\": user_input}), \"\"))\nhttp.request(uri)\n```\n\n### References\nhttps://cwe.mitre.org/data/definitions/93.html\nhttps://docs.python.org/3/library/urllib.parse.html\n\nThanks to Recar https://github.com/Ciyfly for finding vulnerability and discrete notification.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)\n* Email [current maintainer at 2020-05](mailto:temotor@gmail.com)","status":"published","published":"2020-05-20T15:55:47Z","modified":"2024-09-20T21:55:16Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:10.657Z","modified":"2026-06-17T02:49:00.21Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93","CWE-74"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"AZL-109469","title":"CVE-2020-11078 affecting package python-httplib2 0.20.3-3","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:10.657Z","modified":"2026-10-20T10:51:41.744154871Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:10.657Z","modified":"2026-10-26T12:01:19.705978069Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-gg84-qgv9-w4pq","title":"CRLF injection in httplib2","description":"### Impact\nAttacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.\n\nImpacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.\n\n### Patches\nProblem has been fixed in 0.18.0\nSpace, CR, LF characters are now quoted before any use.\nThis solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.\n\n### Workarounds\nCreate URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.\n\n```diff\nuser_input = \" HTTP/1.1\\r\\ninjected: attack\\r\\nignore-http:\"\n-uri = \"https://api.server/?q={}\".format(user_input)\n+uri = urllib.parse.urlunsplit((\"https\", \"api.server\", \"/v1\", urllib.parse.urlencode({\"q\": user_input}), \"\"))\nhttp.request(uri)\n```\n\n### References\nhttps://cwe.mitre.org/data/definitions/93.html\nhttps://docs.python.org/3/library/urllib.parse.html\n\nThanks to Recar https://github.com/Ciyfly for finding vulnerability and discrete notification.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)\n* Email [current maintainer at 2020-05](mailto:temotor@gmail.com)","status":"published","published":"2020-05-20T15:55:47Z","modified":"2026-09-10T03:48:46.567768392Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"RHSA-2020:4605","title":"Red Hat Security Advisory: resource-agents security and bug fix update","status":"published","published":"2024-09-18T04:27:18Z","modified":"2026-06-29T10:32:38Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5003","title":"Red Hat Security Advisory: fence-agents security and bug fix update","status":"published","published":"2024-09-18T04:27:52Z","modified":"2026-06-29T10:32:54Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5004","title":"Red Hat Security Advisory: resource-agents security and bug fix update","status":"published","published":"2024-09-18T04:27:43Z","modified":"2026-06-29T10:32:54Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:2116","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update","status":"published","published":"2024-09-18T04:28:43Z","modified":"2026-06-29T10:35:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:00Z","modified":"2025-10-24T04:48:24Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-2232-1","title":"python-httplib2 - security update","status":"published","published":"2020-06-01T00:00:00Z","modified":"2026-03-09T01:20:19.045224Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0269","title":"Updated python-httplib2 packages fix security vulnerability","description":"Updated python-httplib2 packages fix security vulnerability:\n\nIn httplib2, an attacker controlling unescaped part of uri for\nhttplib2.Http.request() could change request headers and body, send\nadditional hidden requests to same server. This vulnerability impacts\nsoftware that uses httplib2 with uri constructed by string concatenation,\nas opposed to proper urllib building with escaping (CVE-2020-11078).\n","status":"published","published":"2020-07-04T22:47:21Z","modified":"2026-04-16T04:44:22.434978891Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0772-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-05-23T04:05:51Z","modified":"2026-02-04T03:34:16.421858Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0796-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-05-26T12:05:23Z","modified":"2026-02-04T02:34:19.430225Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1806-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 fixes the following issues:\n\n- Update to version 0.19.0 (bsc#1182053).\n- CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).\n","status":"published","published":"2021-07-11T12:03:47Z","modified":"2026-02-04T04:37:55.101654Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11231-1","title":"python36-httplib2-0.19.1-1.2 on GA media","description":"These are all security issues fixed in the python36-httplib2-0.19.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:27.548434Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14141-1","title":"python310-httplib2-0.22.0-4.5 on GA media","description":"These are all security issues fixed in the python310-httplib2-0.22.0-4.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:43:10.750348Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11203-1","title":"python313-httplib2-0.32.0-1.1 on GA media","description":"These are all security issues fixed in the python313-httplib2-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.454008116Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2020-46","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.","status":"published","published":"2020-05-20T16:15:00Z","modified":"2023-11-08T04:02:05.060564Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2021:1637-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n","status":"published","published":"2021-05-19T11:34:19Z","modified":"2026-02-04T02:36:46.730438Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1779-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n   - httplib2 started to use certifi and this is already bent to\n    use system certificate bundle.\n  ","status":"published","published":"2021-05-27T09:44:14Z","modified":"2026-02-04T04:37:34.925217Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1806-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 fixes the following issues:\n\n- Update to version 0.19.0 (bsc#1182053).\n- CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).\n","status":"published","published":"2021-05-31T14:23:28Z","modified":"2026-02-04T04:24:03.995669Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1807-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon-security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle.\n\n- handle the case when validation is disabled correctly.\n  The 'check_hostname' context attribute has to be\n  set first, othewise a 'ValueError: Cannot set\n  verify_mode to CERT_NONE when check_hostname\n  is enabled.' exception is raised.\n\n- handle the case with ssl_version being None correctly\n\n- Use  ssl.create_default_context in the python2 case so that\n  the system wide certificates are loaded as trusted again.\n\n- Source url must be https.\n\n- Spec file cleanups\n\n- Update to 0.10.3\n  *  Fix certificate validation on Python\u003c=2.7.8 without ssl.CertificateError\n- Update to 0.10.2\n  * Just a reupload of 0.10.1, which was broken for Python3\n    because wheel distribution doesn't play well with our 2/3 split code base.\n- Update to 0.10.1\n  * Remove VeriSign Class 3 CA from trusted certs\n  * Add IdenTrust DST Root CA X3\n  * Support for specifying the SSL protocol version (Python v2)\n  * On App Engine use urlfetch's default deadline if None is passed.\n  * Fix TypeError on AppEngine “__init__() got an unexpected keyword argument 'ssl_version’”\n  * Send SNI data for SSL connections on Python 2.7.9+\n  * Verify the server hostname if certificate validation is enabled\n  * Add proxy_headers argument to ProxyInfo constructor\n  * Make disable_ssl_certificate_validation work with Python 3.5.\n  * Fix socket error handling\n- Remove httplib2-bnc-818100.patch, merged upstream.\n\n- Project moved from code.google.com to GitHub, fix the url\n  accordingly\n\n- attempt to build multi-python\n\n- update and cleanup of httplib2-use-system-certs.patch,\n  so that the passthrough is clean for python2 and so that it does\n  the right thing in python3\n  ","status":"published","published":"2021-05-31T14:23:46Z","modified":"2026-02-04T03:55:31.925392Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1808-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - httplib2 started to use certifi and this is already bent to\n    use system certificate bundle\n  ","status":"published","published":"2021-05-31T14:23:58Z","modified":"2026-02-04T02:24:34.533844Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}