CVE-2020-11078

httplib2 project httplib2, fedoraproject fedora, debian linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-11078

Katalog CVE

CVSS 6.8 · Medium EPSS 2,4%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada httplib2 project httplib2, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Rincian

Terbit di NVD
20 Mei 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
2,4% peluang dieksploitasi; lebih tinggi dari 83,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
httplib2 project httplib2 Semua versi sebelum 0.18.0
fedoraproject fedora Versi 31
fedoraproject fedora Versi 32
debian debian linux Versi 8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.