CVE-2021-21240

An uncontrolled resource consumption flaw as found in python-httplib2, due to a flawed regular expression used while parsing the WWW-Authenticate header in an HTTP response. This flaw allows a malicious or compromised server to reply with a crafted sequence of characters in the WWW-Authenticate header, leading to a denial of service of the httplib2 client accessing the server. The highest threat from this vulnerability is to system availability.

Mitigation

Use strict mode to parse WWW-Authenticate headers. This can be done by setting httplib2.USE_WWW_AUTH_STRICT_PARSING = True. Please note, however, that strict mode might lead to bad results in case of ill-formed header values.