CVE-2021-21240

Description

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

1.924

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-21240 are fixed in Python-httplib2 0.19.0	Windows
SUSE-SU-2021:1806-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) python3-httplib2-0.19.0-3.3.1.noarch.rpm	Linux
Vulnerabilities CVE-2021-21240 are fixed in Python-httplib2 for linux 0.19.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234