Bug 1199002 – VUL-1: CVE-2021-41945: python-httpx: Improper input validation

Bug 1199002 - (CVE-2021-41945) VUL-1: CVE-2021-41945: python-httpx: Improper input validation

(CVE-2021-41945)
Summary:	VUL-1: CVE-2021-41945: python-httpx: Improper input validation

Status:	RESOLVED FIXED

Classification:	openSUSE
Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Security
Version:	Leap 15.4
Hardware:	Other Other

Priority:	P4 - Low Severity: Minor (vote)
Target Milestone:	---
Assigned To:	Steve Kowalik
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/330308/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2022-04-29 07:01 UTC by Hu
Modified:	2022-08-05 10:40 UTC (History)
CC List:	0 users

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Hu 2022-04-29 07:01:13 UTC

CVE-2021-41945

Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in
`httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41945
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41945
https://github.com/encode/httpx
https://github.com/encode/httpx/discussions/1831
https://github.com/encode/httpx/issues/2184
http://encode.com
https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571

Comment 1 Hu 2022-04-29 07:01:53 UTC

Affected:
- openSUSE:Factory/python-httpx 0.22.0

Comment 2 Michael Ströder 2022-04-29 08:43:57 UTC

Currently I don't have the time work on this. Please assign to one of the maintainers.

Comment 3 OBSbugzilla Bot 2022-05-02 04:40:03 UTC

This is an autogenerated message for OBS integration:
This bug (1199002) was mentioned in
https://build.opensuse.org/request/show/974250 Factory / python-httpx

Comment 4 Steve Kowalik 2022-05-06 04:23:28 UTC

This has now been published to Factory.

Comment 5 OBSbugzilla Bot 2022-08-05 10:40:03 UTC

This is an autogenerated message for OBS integration:
This bug (1199002) was mentioned in
https://build.opensuse.org/request/show/993256 Factory / python-httpx