6c0c05d6d5
- Fix CVE-2021-21240: httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. - Fix CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. - Use LICENSE file instead of PKG-INFO - pyparsing is a runtime dependency since version 0.19.0 andbd9ee252c8https://github.com/httplib2/httplib2/blob/v0.19.1/CHANGELOG Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit2050b4869d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
13 lines
496 B
Plaintext
13 lines
496 B
Plaintext
config BR2_PACKAGE_PYTHON_HTTPLIB2
|
|
bool "python-httplib2"
|
|
select BR2_PACKAGE_PYTHON_ZLIB if BR2_PACKAGE_PYTHON
|
|
select BR2_PACKAGE_PYTHON_SSL if BR2_PACKAGE_PYTHON
|
|
select BR2_PACKAGE_PYTHON3_ZLIB if BR2_PACKAGE_PYTHON3
|
|
select BR2_PACKAGE_PYTHON3_SSL if BR2_PACKAGE_PYTHON3
|
|
select BR2_PACKAGE_PYTHON_PYPARSING # runtime
|
|
help
|
|
httplib2 is a comprehensive HTTP client library, httplib2.py
|
|
supports many features left out of other HTTP libraries.
|
|
|
|
https://pypi.python.org/pypi/httplib2
|