2050b4869d
- Fix CVE-2021-21240: httplib2 is a comprehensive HTTP client library
for Python. In httplib2 before version 0.19.0, a malicious server
which responds with long series of "\xa0" characters in the
"www-authenticate" header may cause Denial of Service (CPU burn while
parsing header) of the httplib2 client accessing said server. This is
fixed in version 0.19.0 which contains a new implementation of auth
headers parsing using the pyparsing library.
- Fix CVE-2020-11078: In httplib2 before version 0.18.0, an attacker
controlling unescaped part of uri for `httplib2.Http.request()` could
change request headers and body, send additional hidden requests to
same server. This vulnerability impacts software that uses httplib2
with uri constructed by string concatenation, as opposed to proper
urllib building with escaping. This has been fixed in 0.18.0.
- Use LICENSE file instead of PKG-INFO
- pyparsing is a runtime dependency since version 0.19.0 and
bd9ee252c8
https://github.com/httplib2/httplib2/blob/v0.19.1/CHANGELOG
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
13 lines
496 B
Plaintext
13 lines
496 B
Plaintext
config BR2_PACKAGE_PYTHON_HTTPLIB2
|
|
bool "python-httplib2"
|
|
select BR2_PACKAGE_PYTHON_ZLIB if BR2_PACKAGE_PYTHON
|
|
select BR2_PACKAGE_PYTHON_SSL if BR2_PACKAGE_PYTHON
|
|
select BR2_PACKAGE_PYTHON3_ZLIB if BR2_PACKAGE_PYTHON3
|
|
select BR2_PACKAGE_PYTHON3_SSL if BR2_PACKAGE_PYTHON3
|
|
select BR2_PACKAGE_PYTHON_PYPARSING # runtime
|
|
help
|
|
httplib2 is a comprehensive HTTP client library, httplib2.py
|
|
supports many features left out of other HTTP libraries.
|
|
|
|
https://pypi.python.org/pypi/httplib2
|