Description
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| httplib2 | httplib2 | < 0.81.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-httplib2 | 0.18.1-1 | — |
| Debian 13 | python-httplib2 | 0.18.1-1 | — |
| Debian 12 | python-httplib2 | 0.18.1-1 | — |
| Debian 8 | python-httplib2 | 0.9+dfsg-2+deb8u1 | DLA-2232-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-httplib2 | No fix yet | — |
| Ubuntu 18.04 LTS | python-httplib2 | No fix yet | — |
| Ubuntu 16.04 LTS | python-httplib2 | No fix yet | — |
| Ubuntu 14.04 LTS | python-httplib2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | resource-agents +2 | 4.1.1-68.el8 | RHSA-2020:4605 |
| RHEL 7 | fence-agents +43 | 4.2.1-41.el7_9.2 | RHSA-2020:5003 |
| RHEL 7 | resource-agents +4 | 4.1.1-61.el7_9.4 | RHSA-2020:5004 |
| RHEL 7 | resource-agents-sap-hana-scaleout | 0.164.0-6.el7_9.4 | RHSA-2020:5004 |
| RHEL 7 | sap-cluster-connector | 3.0.1-37.el7_9.4 | RHSA-2020:5004 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | python-httplib2 +1 | 0.13.1-2.el8ost | RHSA-2021:2116 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | python-httplib2 | 0.19.0-3.3.1 | SUSE-SU-2021:1806-1 |
| SLES 15 SP2 | python-httplib2 | 0.19.0-3.3.1 | SUSE-SU-2021:1806-1 |
| SLES 15 | python-httplib2 | 0.19.0-1.8.1 | SUSE-SU-2021:1637-1 |
| SLES 12 | python-httplib2 | 0.19.0-7.7.1 | SUSE-SU-2021:1807-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | python-httplib2 | 0.19.0-bp152.3.3.1 | openSUSE-SU-2021:0796-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-httplib2 | 0.19.0-8.3.4 | SUSE-SU-2021:1779-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-httplib2 | 0.19.0-7.3.1 | SUSE-SU-2021:1808-1 |
| SUSE OpenStack Cloud 9 | python-httplib2 | 0.19.0-8.3.4 | SUSE-SU-2021:1779-1 |
| SUSE OpenStack Cloud 8 | python-httplib2 | 0.19.0-7.3.1 | SUSE-SU-2021:1808-1 |
| SUSE OpenStack Cloud 7 | python-httplib2 | 0.19.0-7.7.1 | SUSE-SU-2021:1807-1 |
| SUSE HPE Helion OpenStack 8 | python-httplib2 | 0.19.0-7.3.1 | SUSE-SU-2021:1808-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-httplib2 | 0.19.1-1.2 | openSUSE-SU-2026:11203-1, openSUSE-SU-2024:14141-1, openSUSE-SU-2024:11231-1 |
| openSUSE Leap 15.3 | python-httplib2 | 0.19.0-3.3.1 | openSUSE-SU-2021:1806-1 |
| openSUSE Leap 15.2 | python-httplib2 | 0.19.0-lp152.6.3.1 | openSUSE-SU-2021:0772-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-httplib2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | resource-agents | 4.1.1-68.el8 | ELSA-2020-5947 |
| Oracle Linux 7 | fence-agents-all +37 | 4.2.1-41.el7_9.2 | ELSA-2020-5003 |
| Oracle Linux 7 | resource-agents +2 | 4.1.1-61.el7_9.4 | ELSA-2020-5004 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | httplib2 | < 0.18.0 | 0.18.0 | GHSA-gg84-qgv9-w4pq |
Advisories 20
- openSUSE-SU-2026:11203-1 python313-httplib2-0.32.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 9, 2026
- RHSA-2021:2116 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5003 Red Hat Security Advisory: fence-agents security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5004 Red Hat Security Advisory: resource-agents security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:4605 Red Hat Security Advisory: resource-agents security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-2232-1 python-httplib2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2021:1806-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1779-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11231-1 python36-httplib2-0.19.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1806-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1807-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14141-1 python310-httplib2-0.22.0-4.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0772-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1637-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0796-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1808-1 Security update for python-httplib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0193 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
- ELSA-2020-5004 Low: resource-agents security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 5, 2021
- ELSA-2020-5947 Important: resource-agents security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 24, 2020
- ELSA-2020-5003 Low: fence-agents security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 13, 2020
References
- https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq
- https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e
- [allura-commits] 20200521 [allura] branch master updated: Upgrade httplib2 for CVE-2020-11078 mailing-list
- [debian-lts-announce] 20200601 [SECURITY] [DLA 2232-1] python-httplib2 security update mailing-list
- [beam-issues] 20200602 [jira] [Created] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078 mailing-list
- FEDORA-2020-a7a15a9687 vendor-advisory
- FEDORA-2020-37779a5c93 vendor-advisory
- [beam-issues] 20200802 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078 mailing-list
- [beam-issues] 20200802 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078 mailing-list
- [beam-issues] 20200816 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078 mailing-list
- [beam-issues] 20200816 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078 mailing-list