-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 12 Aug 2026 19:10:52 -0300 Source: python-httplib2 Architecture: source Version: 0.18.1-3+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Emmanuel Arias <eamanu@debian.org> Closes: 982738 Changes: python-httplib2 (0.18.1-3+deb11u1) bullseye-security; urgency=medium . * CVE-2026-59939: The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. This is a classic decompression bomb (zip bomb) attack against the HTTP client. * 0006-Fix-test-according-to-bpo-43882.patch: Add patch to fix a test. * CVE-2021-21240: In httplib2 before version 0.19.0, a malicious server which responds with long series of '\xa0' characters in the 'www-authenticate' header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server (Closes: #982738). - d/control: Add python3-pyparsing as build dependency. * d/salsa-ci.yml: Enable salsa-ci. Checksums-Sha1: 452c47d331644fb84ca4f22a05d05e2158c3f354 2326 python-httplib2_0.18.1-3+deb11u1.dsc 70966545702a15d85b7aff8dba31cb9ef48d2a5d 262930 python-httplib2_0.18.1.orig.tar.gz 42906fa0e965c48d2a649cb1c7d7a627285d6e59 31008 python-httplib2_0.18.1-3+deb11u1.debian.tar.xz 222ceb2d82fd6d923a7bbccd02891b7146e0f593 8636 python-httplib2_0.18.1-3+deb11u1_source.buildinfo Checksums-Sha256: a4ecd533740bb8d9280909b6a1ca132b7d08b87cb2747c078575c33a4490fca3 2326 python-httplib2_0.18.1-3+deb11u1.dsc 8af66c1c52c7ffe1aa5dc4bcd7c769885254b0756e6e69f953c7f0ab49a70ba3 262930 python-httplib2_0.18.1.orig.tar.gz 748c45a696621ccca5ff0a315066a4096c59b4d6a212d8e4866f5b876057e442 31008 python-httplib2_0.18.1-3+deb11u1.debian.tar.xz af3db40abd63f148f928dfd4ae23a16b26215a7f03cbb3ac3340237c2f51c61c 8636 python-httplib2_0.18.1-3+deb11u1_source.buildinfo Files: 508f9522f2091fc07ece635fcf974772 2326 python optional python-httplib2_0.18.1-3+deb11u1.dsc 0b331f96cdb2ae0e0342d4ea0f5f0502 262930 python optional python-httplib2_0.18.1.orig.tar.gz 97d1eb0333b7eebd7b8c69d6d041362e 31008 python optional python-httplib2_0.18.1-3+deb11u1.debian.tar.xz 8c19be814878ae1837c302aa79f0ad0f 8636 python optional python-httplib2_0.18.1-3+deb11u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmqHSakSHGVhbWFudUBk ZWJpYW4ub3JnAAoJEPqd7F3hHGPxe0AP/0R5qEEk7aj+Wn9Mmpl2acRibNkNfGe1 VoZim7LY1kbQzEALVhlAx1M7PQUE1GpCo6MH7/5bbslKHDhHPKm/tNSBKOrESCFE 3D/JdHbk8m4HVl2FKV/gOcX0uJqtvnGK5gJIDEn7PZm9eaanIgmVvNunLxD9HJbT FoQbxB+1wb1QSOAK5nehMrWgjtUW+zWxqAvNOZmD58g/cHBzbGPWe7DfPaL0YfcV WGNVPxWMdHlmS1MUNHgKk52oyyreFm6IP0rG/c4Y62uED6BmxotW6NTMSjpeP5pL Mr0mn4CIifn0+AALE/vghJVNtVq5bZp0APlaIlOsrPlvviRui5/Ixtc2p9DytMf3 nJPHe+p4sbb6V4fPM/AI/Zog1yR5jpTTWeCb2Wa2ePDmQZH5fvJAUYjOyOlyELtb vdEs5aZzWizUWkhgVHEnyThnWcE4fTGOCKYDNYrd2eECKlM1fiAsGc7NPZxWNtZQ aZWeJhkZPOJueFW0lkTvGo3UfTL/hHUaunfUkZWdSClE5/EJnpZqJVkrdVxkmZSE AUDvBwXsEjeX3jIeA7Syq6m3s2foA27/t7XWuKsvCAW0SC7rF0Rvb9XHFz9Rdbh0 e++tKAr7i2RG/35/scpfAWjDjcmTJvxQA8mRLqDUrcL1eWcKSds2T/ssPqr5bmMc +D5P3yBOIA6l =9D3z -----END PGP SIGNATURE-----
