CVE-2020-11078: 
Python vulnerability analysis and mitigation

CVE-2020-11078 affects httplib2 versions before 0.18.0. The vulnerability was discovered in May 2020 and involves a CRLF injection vulnerability in the httplib2.Http.request() function. The issue affects software that uses httplib2 with URI constructed by string concatenation, rather than proper urllib building with escaping (GitHub Advisory).

The vulnerability is classified as CWE-93 (CRLF Injection) with a CVSS 3.1 base score of 6.8 (Medium). An attacker controlling unescaped parts of URIs could manipulate request headers and body, potentially sending additional hidden requests to the same server. The vulnerability specifically occurs when URIs are constructed through string concatenation instead of using proper URL building methods with escaping (NVD).

When exploited, this vulnerability allows attackers to modify HTTP request headers and body content, and potentially send hidden requests to the target server. This could lead to request manipulation and potential security bypass scenarios (GitHub Advisory).

The vulnerability requires an attacker to control unescaped parts of the URI used in httplib2.Http.request() calls. The attack is particularly effective against applications that construct URIs through string concatenation rather than using proper URL building methods (GitHub Advisory).

The vulnerability was fixed in httplib2 version 0.18.0 by implementing proper escaping of space, CR, and LF characters before any URI use. As a workaround, users should create URIs using urllib.parse family functions (urlencode, urlunsplit) instead of string concatenation. The fix should not impact any valid usage of the httplib2 library when URIs are properly constructed using urllib (GitHub Advisory).

Multiple Linux distributions including Debian, Fedora, and Ubuntu acknowledged and addressed the vulnerability through security updates. Debian classified it as a minor issue and released fixes in version 0.9+dfsg-2+deb8u1 (Debian Advisory). Fedora provided updates for both Fedora 31 and 32 to address the vulnerability (Fedora Update).