TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2019-119
Aliases: CVE-2019-1010259
Published: 2019-07-18T17:15:00Z

SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Vulnerability: PYSEC-2022-79
Aliases: CVE-2022-23570, GHSA-9p77-mmrw-69c7
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a `DCHECK`. However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-44
Aliases: GHSA-g57j-q48p-9vm2, CVE-2020-7698, SNYK-PYTHON-GERAPY-572470
Published: 2020-07-29T13:15:00Z

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
Vulnerability: PYSEC-2015-35
Aliases: CVE-2015-0838
Published: 2015-03-31T14:59:00Z

Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Vulnerability: PYSEC-2020-325
Aliases: CVE-2020-15210, GHSA-x9j7-x98r-r4w2
Published: 2020-09-25T19:15:00Z

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Vulnerability: PYSEC-2019-226
Aliases: CVE-2018-8825
Published: 2019-04-23T21:29:00Z

Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).
Vulnerability: PYSEC-2021-775
Aliases: CVE-2021-37664, GHSA-r4c4-5fpq-56wg
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) needs to validate that each value in `stats_summary_indices` is in range. We have patched the issue in GitHub commit e84c975313e8e8e38bb2ea118196369c45c51378. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-325
Aliases: CVE-2021-32838, GHSA-3q6g-vf58-7m4g
Published: 2021-09-20T18:15:00Z

Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
Vulnerability: PYSEC-2019-16
Aliases: CVE-2019-19844, GHSA-vfq6-hq5r-27r6
Published: 2019-12-18T19:15:00Z

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Vulnerability: PYSEC-2021-90
Aliases: GHSA-434h-p4gx-jm89, CVE-2021-29621
Published: 2021-06-07T19:15:00Z

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
Vulnerability: PYSEC-2021-630
Aliases: CVE-2021-41221, GHSA-cqv6-3phm-hcwx
Published: 2021-11-05T23:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-hgc3-hp6x-wpgx
Summary: Antilles Dependency Confusion Vulnerability
Aliases: CVE-2021-3840
Severity: HIGH
CWE: CWE-427
Published: 2021-11-03T17:36:22Z

### Potential Impact: 
Remote code execution.

### Scope of Impact: 
Open-source project specific.

### Summary Description:
A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). 
MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi.
The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.

### Mitigation Strategy for Customers (what you should do to protect yourself):
Remove previous versions of Antilles as a precautionary measure and Update to version 1.0.1 or later.

### Acknowledgement:
The Antilles team thanks Kotko Vladyslav for reporting this issue.

### References:
https://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9
Vulnerability: GHSA-976r-qfjj-c24w
Summary: Command injection via Celery broker in Apache Airflow
Aliases: CVE-2020-11981
Severity: CRITICAL
CWE: CWE-78
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Vulnerability: PYSEC-2021-260
Aliases: GHSA-hwr7-8gxx-fj5p, CVE-2021-37638
Published: 2021-08-12T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty. We have patched the issue in GitHub commit 301ae88b331d37a2a16159b65b255f4f9eb39314. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-jx8f-cpx7-fv47
Summary: Allocation of Resources Without Limits or Throttling in nvflare
Aliases: CVE-2022-21822
Severity: HIGH
CWE: CWE-770
Published: 2022-03-18T23:18:43Z

### Impact
NVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable

All versions before 2.0.16 are affected.

### Patches
The patch will be included in nvflare==2.0.16.

### Workarounds
The changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e  can be applied to any version of the NVIDIA FLARE without any adverse effect.

### Additional information
Issue Found on: 2022.3.3
Issue Found by: Oliver Sellwood (@Nintorac)
Vulnerability: GHSA-r6jx-9g48-2r5r
Summary: Arbitrary code execution due to YAML deserialization
Aliases: CVE-2021-37678
Severity: CRITICAL
CWE: CWE-502
Published: 2021-08-25T14:41:12Z

### Impact
TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.

```python
from tensorflow.keras import models

payload = '''
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
'''
  
models.model_from_yaml(payload)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input.

### Patches
Given that YAML format support requires a significant amount of work, we have removed it for now.

We have patched the issue in GitHub commit [23d6383eb6c14084a8fc3bdf164043b974818012](https://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Arjun Shibu.
Vulnerability: PYSEC-2020-260
Aliases: GHSA-p5xh-vx83-mxcj, CVE-2020-10109
Published: 2020-03-12T13:15:00Z

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Vulnerability: PYSEC-2021-149
Aliases: GHSA-4278-2v5v-65r4, CVE-2021-29512
Published: 2021-05-14T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433). Before the `for` loop, `batch_idx` is set to 0. The user controls the `splits` array, making it contain only one element, 0. Thus, the code in the `while` loop would increment `batch_idx` and then try to read `splits(1)`, which is outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected.
Vulnerability: PYSEC-2021-519
Aliases: CVE-2021-29591, GHSA-cwv3-863g-39vx
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be replaced by stack overflow due to too many recursive calls. For example, the `While` implementation(https://github.com/tensorflow/tensorflow/blob/106d8f4fb89335a2c52d7c895b7a7485465ca8d9/tensorflow/lite/kernels/while.cc) could be tricked into a scneario where both the body and the loop subgraphs are the same. Evaluating one of the subgraphs means calling the `Eval` function for the other and this quickly exhaust all stack space. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Please consult our security guide(https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2014-18
Aliases: CVE-2014-3563
Published: 2014-08-22T17:55:00Z

Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Vulnerability: PYSEC-2016-25
Aliases: CVE-2016-1000001
Published: 2016-10-07T18:59:00Z

flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect
Vulnerability: GHSA-h5jv-4p7w-64jg
Summary: Uncontrolled Resource Consumption in Django
Aliases: CVE-2019-14233
Severity: HIGH
CWE: CWE-400
Published: 2019-08-06T01:43:33Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
Vulnerability: PYSEC-2020-149
Aliases: GHSA-hmv2-79q8-fv6g, CVE-2020-7212
Published: 2020-03-06T20:15:00Z

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Vulnerability: GHSA-73m2-3pwg-5fgc
Summary: Catastrophic backtracking in regex allows Denial of Service in Waitress
Aliases: CVE-2020-5236
Severity: CRITICAL
CWE: CWE-400
Published: 2020-02-04T03:07:31Z

### Impact

When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions.

This would allow an attacker to send a single request with an invalid header and take the service offline.

Invalid header example:

```
Bad-header: xxxxxxxxxxxxxxx\x10
```

Increasing the number of `x`'s in the header will increase the amount of time Waitress spends in the regular expression engine.

This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230.

### Patches

The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

### Workarounds

If you have deployed a reverse proxy in front of Waitress it may already be rejecting requests that include invalid headers.

### Thanks

The Pylons Project would like to thank [Fil Zembowicz](https://github.com/fzembow) for reaching out and disclosing this vulnerability!

### References

Catastrophic backtracking explained: https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:

- open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: PYSEC-2022-80
Aliases: GHSA-j3mj-fhpq-qqjj, CVE-2022-23571
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments, if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-52
Aliases: GHSA-cg54-gpgr-4rm6, CVE-2020-26261
Published: 2020-12-09T17:15:00Z

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Vulnerability: PYSEC-2022-140
Aliases: GHSA-wm93-f238-7v37, CVE-2022-23576
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-6qmf-fj6m-686c
Summary: Open Redirect in Flask-Security-Too
Aliases: CVE-2021-32618
Severity: LOW
CWE: CWE-601
Published: 2021-05-17T20:51:27Z

### Impact
Flask-Security allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting  URL.

This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com
will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want.

This is considered a low severity due to the fact that if Werkzeug by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False` which would then open up their application to this attack.

### Patches
No patches as this time

### Workarounds
If using Werkzeug, make sure to use the default Location header setting. If you can't - then use@app.after_request and write your own validation of the Location header if it is set.

### References
No.

### For more information
If you have any questions or comments about this advisory follow: https://github.com/Flask-Middleware/flask-security/issues/486

Thanks to Claroty (2021-0141) and @snoopysecurity for providing details and proof of concept.
Vulnerability: GHSA-3h8m-483j-7xxm
Summary: Heap out of bounds read in `RequantizationRange`
Aliases: CVE-2021-29569
Severity: LOW
CWE: CWE-125
Published: 2021-05-21T14:25:22Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:

```python
import tensorflow as tf

input = tf.constant([1], shape=[1], dtype=tf.qint32) 
input_max = tf.constant([], dtype=tf.float32)
input_min = tf.constant([], dtype=tf.float32)

tf.raw_ops.RequantizationRange(input=input, input_min=input_min, input_max=input_max)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantization_range_op.cc#L49-L50) assumes that the `input_min` and `input_max` tensors have at least one element, as it accesses the first element in two arrays:

```cc
const float input_min_float = ctx->input(1).flat<float>()(0);
const float input_max_float = ctx->input(2).flat<float>()(0);
```

If the tensors are empty, `.flat<T>()` is an empty object, backed by an empty array. Hence, accesing even the 0th element is a read outside the bounds.

### Patches
We have patched the issue in GitHub commit [ef0c008ee84bad91ec6725ddc42091e19a30cf0e](https://github.com/tensorflow/tensorflow/commit/ef0c008ee84bad91ec6725ddc42091e19a30cf0e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-3vcg-8p79-jpcv
Summary: Improper Restriction of XML External Entity Reference in svglib
Aliases: CVE-2020-10799
Severity: HIGH
CWE: CWE-611
Published: 2021-05-06T18:52:01Z

The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
Vulnerability: PYSEC-2021-372
Aliases: CVE-2021-41132, GHSA-g67g-hvc3-xmvf
Published: 2021-10-14T16:15:00Z

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.
Vulnerability: PYSEC-2019-41
Aliases: GHSA-qfc5-mcwq-26q8, CVE-2019-18874
Published: 2019-11-12T02:15:00Z

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Vulnerability: GHSA-mcg6-h362-cmq5
Summary: Improper Authorization in cobbler
Aliases: CVE-2022-0860
Severity: HIGH
CWE: CWE-863, CWE-285
Published: 2022-03-11T20:52:04Z

### Impact

If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI & XMLRPC-API).

The same applies to user accounts with passwords set to be expired.

### Patches

There is a patch for the latest Cobbler `3.3.2` available, however a backport will be done for `3.2.x`.

### Workarounds

- Delete expired accounts which are able to access Cobbler via PAM.
- Use `chage -l <username>` to lock the account. If the account has SSH-Keys attached then remove them completely.

### References

- Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/

### How to test if my Cobbler instance is affected?

The following `pytest` test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.

```python
def test_pam_login_with_expired_user():
    # Arrange
    # create pam testuser
    test_username = "expired_user"
    test_password = "password"
    test_api = CobblerAPI()
    subprocess_1 = subprocess.run(
        ["perl", "-e", "'print crypt(\"%s\", \"%s\")'" % (test_username, test_password)],
        stdout=subprocess.PIPE
    )
    subprocess.run(["useradd", "-p", subprocess_1.stdout, test_username])
    # change user to be expired
    subprocess.run(["chage", "-E0", test_username])

    # Act
    result = pam.authenticate(test_api, test_username, test_password)

    # Assert - login should fail
    assert not result
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Cobbler repository](https://github.com/cobbler/cobbler/issues/new/choose)
* Ask in the [Gitter/Matrix Chat](https://gitter.im/cobbler/community)
* Email us at [cobbler.project@gmail.com](mailto:cobbler.project@gmail.com)
Vulnerability: PYSEC-2021-688
Aliases: CVE-2021-29562, GHSA-36vm-xw34-x4pj
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.IRFFT`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-722
Aliases: GHSA-4vrf-ff7v-hpgr, CVE-2021-29596
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `EmbeddingLookup` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e4b29809543b250bc9b19678ec4776299dd569ba/tensorflow/lite/kernels/embedding_lookup.cc#L73-L74). An attacker can craft a model such that the first dimension of the `value` input is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2011-21
Aliases: GHSA-4m72-rmm9-2qjr, CVE-2011-1158
Published: 2011-04-11T18:55:00Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
Vulnerability: GHSA-hwr7-8gxx-fj5p
Summary: Null pointer dereference in `RaggedTensorToTensor`
Aliases: CVE-2021-37638
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T14:44:09Z

### Impact
Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToTensor(
  shape=1,
  values=10,
  default_value=21,
  row_partition_tensors=tf.constant([0,0,0,0]),
  row_partition_types=[])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty.

### Patches
We have patched the issue in GitHub commit [301ae88b331d37a2a16159b65b255f4f9eb39314](https://github.com/tensorflow/tensorflow/commit/301ae88b331d37a2a16159b65b255f4f9eb39314).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2020-237
Aliases: GHSA-4mp3-385r-v63f, CVE-2020-26890
Published: 2020-11-24T03:15:00Z

Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
Vulnerability: GHSA-h8pj-cxx2-jfg2
Summary: Improper Input Validation in httpx
Aliases: CVE-2021-41945
Severity: MODERATE
CWE: CWE-20
Published: 2022-04-29T00:00:25Z

Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
Vulnerability: GHSA-q8gv-q7wr-9jf8
Summary: Segfault in Tensorflow
Aliases: CVE-2020-15204
Severity: MODERATE
CWE: CWE-476
Published: 2020-09-25T18:28:41Z

### Impact
In eager mode, TensorFlow does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/session_ops.cc#L45

In the above snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault.

### Patches
We have patched the issue in 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-237
Aliases: GHSA-j8qh-3xrq-c825, CVE-2021-29600
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `OneHot` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/f61c57bd425878be108ec787f4d96390579fb83e/tensorflow/lite/kernels/one_hot.cc#L68-L72). An attacker can craft a model such that at least one of the dimensions of `indices` would be 0. In turn, the `prefix_dim_size` value would become 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-jwqp-28gf-p498
Summary: HTTP authentication credentials potentially leaked to target websites 
Aliases: CVE-2021-41125
Severity: MODERATE
CWE: CWE-522, CWE-200
Published: 2021-10-06T17:46:22Z

### Impact

If you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target.

This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects.

### Patches

Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials.

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead.

### Workarounds

If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the [`w3lib.http.basic_auth_header`](https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header) function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Vulnerability: PYSEC-2021-667
Aliases: CVE-2021-29541, GHSA-xqfj-35wv-m3cr
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null pointer in `tf.raw_ops.StringNGrams`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1cdd4da14282210cc759e468d9781741ac7d01bf/tensorflow/core/kernels/string_ngrams_op.cc#L67-L74) does not fully validate the `data_splits` argument. This would result in `ngrams_data`(https://github.com/tensorflow/tensorflow/blob/1cdd4da14282210cc759e468d9781741ac7d01bf/tensorflow/core/kernels/string_ngrams_op.cc#L106-L110) to be a null pointer when the output would be computed to have 0 or negative size. Later writes to the output tensor would then cause a null pointer dereference. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2013-8
Aliases: CVE-2013-1629
Published: 2013-08-06T02:52:00Z

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Vulnerability: GHSA-ffq8-576r-v26g
Summary: High severity vulnerability that affects hpack
Aliases: CVE-2016-6581
Severity: HIGH
Published: 2019-07-05T21:11:05Z

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
Vulnerability: GHSA-qhxx-j73r-qpm2
Summary: Uninitialized memory access in TensorFlow
Aliases: CVE-2020-26266
Severity: LOW
CWE: CWE-908
Published: 2020-12-10T19:07:24Z

### Impact
Under certain cases, a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to [default initialize the quantized floating point types in Eigen](https://github.com/tensorflow/tensorflow/blob/f70160322a579144950dff1537dcbe3c7c09d6f5/third_party/eigen3/unsupported/Eigen/CXX11/src/FixedPoint/FixedPointTypes.h#L61-L104):

```cc
struct QUInt8 {
  QUInt8() {}
  // ...
  uint8_t value;
};

struct QInt16 {
  QInt16() {}
  // ...
  int16_t value;
};

struct QUInt16 {
  QUInt16() {}
  // ...
  uint16_t value;
};

struct QInt32 {
  QInt32() {}
  // ...
  int32_t value;
};
```

### Patches
We have patched the issue in GitHub commit [ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2](https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-2hwx-mjrm-v3g8
Summary: Denial of service attack via .well-known lookups
Aliases: CVE-2021-21274
Severity: MODERATE
CWE: CWE-400
Published: 2021-03-01T19:34:54Z

### Impact
A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver.

This affects any server which accepts federation requests from untrusted servers.

### Patches
Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108.

### Workarounds
The `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
Vulnerability: PYSEC-2022-117
Aliases: GHSA-x4qx-4fjv-hmw6, CVE-2022-21738
Published: 2022-02-03T14:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-7r94-xv9v-63jw
Summary: A use of uninitialized value vulnerability in Tensorflow
Aliases: CVE-2021-41225
Severity: MODERATE
CWE: CWE-908
Published: 2021-11-10T18:44:11Z

### Impact
TensorFlow's Grappler optimizer has a [use of unitialized variable](https://github.com/tensorflow/tensorflow/blob/3457a2b122e50b4d44ceaaed5a663d635e5c22df/tensorflow/core/grappler/optimizers/auto_parallel.cc#L155-L164):

```cc
  const NodeDef* dequeue_node;
  for (const auto& train_node : train_nodes) {
    if (IsDequeueOp(*train_node)) {
      dequeue_node = train_node;
      break;
    }
  }

  if (dequeue_node) {
    ...
  }
```

If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized.

### Patches
We have patched the issue in GitHub commit [68867bf01239d9e1048f98cbad185bf4761bedd3](https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Qian Feng from Baidu Security Team.
Vulnerability: PYSEC-2019-158
Aliases: GHSA-rcx2-m7jp-p9wj, CVE-2019-10856
Published: 2019-04-04T16:29:00Z

In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
Vulnerability: GHSA-vq2r-5xvm-3hc3
Summary: Segfault in `CTCBeamSearchDecoder`
Aliases: CVE-2021-29581
Severity: LOW
CWE: CWE-908
Published: 2021-05-21T14:26:30Z

### Impact
Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults:

```python
import tensorflow as tf

inputs = tf.constant([], shape=[18, 8, 0], dtype=tf.float32)
sequence_length = tf.constant([11, -43, -92, 11, -89, -83, -35, -100],
shape=[8], dtype=tf.int32)
beam_width = 10
top_paths = 3
merge_repeated = True

tf.raw_ops.CTCBeamSearchDecoder(
  inputs=inputs, sequence_length=sequence_length, beam_width=beam_width,
  top_paths=top_paths, merge_repeated=merge_repeated)
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/a74768f8e4efbda4def9f16ee7e13cf3922ac5f7/tensorflow/core/kernels/ctc_decoder_ops.cc#L68-L79) fails to detect cases when the input tensor is empty and proceeds to read data from a null buffer.
  
### Patches
We have patched the issue in GitHub commit [b1b323042264740c398140da32e93fb9c2c9f33e](https://github.com/tensorflow/tensorflow/commit/b1b323042264740c398140da32e93fb9c2c9f33e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: PYSEC-2018-83
Aliases: CVE-2017-0359, GHSA-8p5c-f328-9fvv
Published: 2018-04-13T16:29:00Z

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Vulnerability: PYSEC-2022-38
Aliases: CVE-2021-45083, GHSA-5946-mpw5-pqxx
Published: 2022-02-20T18:15:00Z

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.
Vulnerability: GHSA-hxfw-jm98-v4mq
Summary: Divide By Zero in OpenCV.
Aliases: CVE-2019-15939
Severity: MODERATE
CWE: CWE-369
Published: 2021-10-12T22:21:56Z

An issue was discovered in OpenCV 4.1.0 (OpenCV-Python 4.1.0.25). There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
Vulnerability: PYSEC-2021-53
Aliases: CVE-2021-25284
Published: 2021-02-27T05:15:00Z

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
Vulnerability: GHSA-7r7m-5h27-29hp
Summary: Potential infinite loop in Pillow
Aliases: CVE-2021-28676
Severity: HIGH
CWE: CWE-835
Published: 2021-06-08T18:48:53Z

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Vulnerability: PYSEC-2021-309
Aliases: GHSA-jwf9-w5xm-f437, CVE-2021-37687
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`GatherNd` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather_nd.cc#L124) does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in `indices`. Similar issue exists in [`Gather` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather.cc). We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-qm57-vhq3-3fwf
Summary: Header injection possible in Django
Aliases: CVE-2021-32052
Severity: MODERATE
CWE: CWE-88, CWE-79
Published: 2021-06-09T17:14:51Z

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Vulnerability: GHSA-rhm9-p9w5-fwm7
Summary: Symmetrically encrypting large values can lead to integer overflow
Aliases: CVE-2020-36242
Severity: CRITICAL
CWE: CWE-190, CWE-787
Published: 2021-02-10T01:32:27Z

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of `update()` calls with large values (multiple GBs) for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of buffers. This is patched in version 3.3.2 and newer.
Vulnerability: GHSA-93xj-8mrv-444m
Summary: Regular Expression Denial of Service (REDoS) in httplib2
Aliases: CVE-2021-21240
Severity: LOW
CWE: CWE-400
Published: 2021-02-08T19:41:59Z

### Impact
A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches
Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.
https://github.com/httplib2/httplib2/pull/182

### Workarounds
```py
import httplib2
httplib2.USE_WWW_AUTH_STRICT_PARSING = True
```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

    \s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

    www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py
from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces):
    repeat = "\xa0" * n_spaces
    return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.log_request(401)
        self.send_response_only(401)  # Don't bother sending Server and Date
        n_spaces = (
            int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences
            if len(self.path) > 1 else
            65512  # Max header line length 65536
        )
        value = make_header_value(n_spaces)
        self.send_header("www-authenticate", value)  # This header can actually be sent multiple times
        self.end_headers()

if __name__ == "__main__":
    HTTPServer(("", 1337), Handler).serve_forever()
```

Connect to the server with httplib2:

```py
import httplib2
httplib2.Http(".cache").request("http://localhost:1337", "GET")
```

To benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000


### References
Thanks to [Ben Caller](https://github.com/b-c-ds) ([Doyensec](https://doyensec.com)) for finding vulnerability and discrete notification.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)
* Email [current maintainer at 2021-01](mailto:temotor@gmail.com)