This update for python-httplib2 contains the following fixes:
Security fixes included in this update:
- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).
- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).
Non-security fixes included in this update:
-
Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)
-
update to 0.19.0:
- auth: parse headers using pyparsing instead of regexp
- auth: WSSE token needs to be string not bytes
-
update to 0.18.1: (bsc#1171998, CVE-2020-11078)
- explicit build-backend workaround for pip build isolation bug
- IMPORTANT security vulnerability CWE-93 CRLF injection
Force %xx quote of space, CR, LF characters in uri.
- Ship test suite in source dist
-
update to 0.17.3:
-
Update to 0.17.1
- python3: no_proxy was not checked with https
- feature: Http().redirect_codes set, works after follow(_all)_redirects check
This allows one line workaround for old gcloud library that uses 308
response without redirect semantics.
- IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects
- proxy: username/password as str compatible with pysocks
- python2: regression in connect() error handling
- add support for password protected certificate files
- feature: Http.close() to clean persistent connections and sensitive data
-
Update to 0.14.0:
- Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError
-
version update to 0.13.1
0.13.1
- Python3: Use no_proxy
https://github.com/httplib2/httplib2/pull/140
0.13.0
- Allow setting TLS max/min versions
https://github.com/httplib2/httplib2/pull/138
0.12.3
- No changes to library. Distribute py3 wheels.
0.12.1
- Catch socket timeouts and clear dead connection
https://github.com/httplib2/httplib2/issues/18
https://github.com/httplib2/httplib2/pull/111
- Officially support Python 3.7...