2050b4869d
- Fix CVE-2021-21240: httplib2 is a comprehensive HTTP client library
for Python. In httplib2 before version 0.19.0, a malicious server
which responds with long series of "\xa0" characters in the
"www-authenticate" header may cause Denial of Service (CPU burn while
parsing header) of the httplib2 client accessing said server. This is
fixed in version 0.19.0 which contains a new implementation of auth
headers parsing using the pyparsing library.
- Fix CVE-2020-11078: In httplib2 before version 0.18.0, an attacker
controlling unescaped part of uri for `httplib2.Http.request()` could
change request headers and body, send additional hidden requests to
same server. This vulnerability impacts software that uses httplib2
with uri constructed by string concatenation, as opposed to proper
urllib building with escaping. This has been fixed in 0.18.0.
- Use LICENSE file instead of PKG-INFO
- pyparsing is a runtime dependency since version 0.19.0 and
bd9ee252c8
https://github.com/httplib2/httplib2/blob/v0.19.1/CHANGELOG
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
6 lines
332 B
Plaintext
6 lines
332 B
Plaintext
# md5, sha256 from https://pypi.org/pypi/httplib2/json
|
|
md5 de7f5e3a4adb3105889867327bdd39dc httplib2-0.19.1.tar.gz
|
|
sha256 0b12617eeca7433d4c396a100eaecfa4b08ee99aa881e6df6e257a7aad5d533d httplib2-0.19.1.tar.gz
|
|
# Locally computed sha256 checksums
|
|
sha256 589eec38f72df2be203711d3b8cbece9b908c5e7ff00bc3cab7f63bae9e366b4 LICENSE
|