CRLF injection in httplib2
Priority LOW 35CWE-93Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 12 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Why it matters now
EPSS 0.02427 84th percentileScored 2026-11-07
Fix Partial httplib2 (httplib2): 0.81.0httplib2 (PyPI): 0.18.0Red Hat: 4 advisoriesRed Hat: 12 fixed, 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| httplib2 | httplib2 | before 0.81.0 | 0.81.0 | Patch available | CNA |
| — | httplib2 (PyPI) | before 0.18.0 | 0.18.0 | Patch available | GHSA-gg84-qgv9-w4pq |
- httplib2 Vendorhttplib2 Affected before 0.81.0 Fixed in 0.81.0 Patch available CNA
- httplib2 (PyPI) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-gg84-qgv9-w4pq
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:*:*:* | before 0.18.0 | Vulnerable | httplib2 |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
- cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:*:*:* Versions before 0.18.0 Vulnerable ·httplib2
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
Remediation
- Fix · CNA httplib2 (httplib2) Fixed in 0.81.0
- Fix · GHSA-gg84-qgv9-w4pq httplib2 (PyPI) Fixed in 0.18.0 Advisory →
Red Hat 4 advisories
- RHSA-2021:2116 Released 2021-05-26 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1.6 (python-httplib2) security update
- Red Hat OpenStack Platform 16.1 python-httplib2-0.13.1-2.el8ost, python3-httplib2-0.13.1-2.el8ost
- RHSA-2020:5003 Released 2020-11-10 · Red Hat rating Lowfence-agents security and bug fix update
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) fence-agents-lpar-4.2.1-41.el7_9.2, fence-agents-virsh-4.2.1-41.el7_9.2
- Red Hat Enterprise Linux Server (v. 7) fence-agents-4.2.1-41.el7_9.2, fence-agents-all-4.2.1-41.el7_9.2, fence-agents-amt-ws-4.2.1-41.el7_9.2 +36
- Red Hat Enterprise Linux Server High Availability (v. 7) fence-agents-aliyun-4.2.1-41.el7_9.2, fence-agents-aws-4.2.1-41.el7_9.2, fence-agents-azure-arm-4.2.1-41.el7_9.2 +1
- Red Hat Enterprise Linux Server Optional (v. 7) fence-agents-lpar-4.2.1-41.el7_9.2, fence-agents-virsh-4.2.1-41.el7_9.2
- Red Hat Enterprise Linux Server Resilient Storage (v. 7) fence-agents-aliyun-4.2.1-41.el7_9.2, fence-agents-aws-4.2.1-41.el7_9.2, fence-agents-azure-arm-4.2.1-41.el7_9.2 +1
- Red Hat Enterprise Linux Workstation (v. 7) fence-agents-4.2.1-41.el7_9.2, fence-agents-all-4.2.1-41.el7_9.2, fence-agents-amt-ws-4.2.1-41.el7_9.2 +34
- Red Hat Enterprise Linux Workstation Optional (v. 7) fence-agents-lpar-4.2.1-41.el7_9.2, fence-agents-virsh-4.2.1-41.el7_9.2
- RHSA-2020:5004 Released 2020-11-10 · Red Hat rating Lowresource-agents security and bug fix update
- Red Hat Enterprise Linux Server High Availability (v. 7) resource-agents-4.1.1-61.el7_9.4, resource-agents-aliyun-4.1.1-61.el7_9.4, resource-agents-gcp-4.1.1-61.el7_9.4
- Red Hat Enterprise Linux Server Resilient Storage (v. 7) resource-agents-4.1.1-61.el7_9.4, resource-agents-aliyun-4.1.1-61.el7_9.4, resource-agents-gcp-4.1.1-61.el7_9.4
- Red Hat Enterprise Linux for SAP (v. 7) resource-agents-4.1.1-61.el7_9.4, resource-agents-sap-4.1.1-61.el7_9.4, sap-cluster-connector-3.0.1-37.el7_9.4
- Red Hat Enterprise Linux for SAP HANA (v. 7) resource-agents-4.1.1-61.el7_9.4, resource-agents-sap-hana-4.1.1-61.el7_9.4, resource-agents-sap-hana-scaleout-0.164.0-6.el7_9.4
Show 1 more Red Hat advisories
- RHSA-2020:4605 Released 2020-11-04 · Red Hat rating Lowresource-agents security and bug fix update
- Red Hat Enterprise Linux High Availability (v. 8) resource-agents-4.1.1-68.el8, resource-agents-aliyun-4.1.1-68.el8, resource-agents-gcp-4.1.1-68.el8
- Red Hat Enterprise Linux Resilient Storage (v. 8) resource-agents-4.1.1-68.el8, resource-agents-aliyun-4.1.1-68.el8, resource-agents-gcp-4.1.1-68.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Engine 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Tower 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:5003 |
| Red Hat Enterprise Linux High Availability (v. 8) | Fixed | RHSA-2020:4605 |
| Red Hat Enterprise Linux Resilient Storage (v. 8) | Fixed | RHSA-2020:4605 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:5003 |
| Red Hat Enterprise Linux Server High Availability (v. 7) | Fixed | RHSA-2020:5003, RHSA-2020:5004 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:5003 |
| Red Hat Enterprise Linux Server Resilient Storage (v. 7) | Fixed | RHSA-2020:5003, RHSA-2020:5004 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:5003 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:5003 |
| Red Hat Enterprise Linux for SAP (v. 7) | Fixed | RHSA-2020:5004 |
| Red Hat Enterprise Linux for SAP HANA (v. 7) | Fixed | RHSA-2020:5004 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2021:2116 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11078
- 2026-10-03 Alias added: GHSA-gg84-qgv9-w4pq
References
Patch 2
Advisory 4
Other 16
- [allura-commits] 20200521 [allura] branch master updated: Upgrade httplib2 for CVE-2020-11078
- [beam-issues] 20200602 [jira] [Created] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078
- [beam-issues] 20200802 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078
- [beam-issues] 20200802 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078
- [beam-issues] 20200816 [jira] [Commented] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078
- [beam-issues] 20200816 [jira] [Updated] (BEAM-10180) Upgrade httplib2 to > 0.18.0 to resolve CVE-2020-11078
- https://github.com/httplib2/httplib2
- https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2020-46.yaml
- https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E
- https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E
- https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E
- https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E
- https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E
- https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI
More Httplib2 vulnerabilities
- TI-2026-42746 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling CVSS 3.1HIGH 7.5
- TI-2021-04343 Regular Expression Denial of Service in httplib2 CVSS 3.1HIGH 7.5
- TI-2013-01808 httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify… CVSS 2.0LOW 2.6
Sources
- CVE-2020-11078 · CVE Program
- CVE-2020-11078 · NVD
- FIRST EPSS
- GHSA-gg84-qgv9-w4pq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11078 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences