Insufficiently Protected Credentials in Requests

HIGH 7.5CVE-2018-18074 · GHSA-x84v-xcm2-53pg · PYSEC-2018-28 · Published 09/10/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
requests PyPI	`< 2.20.0`	`2.20.0`
requests python	`< 2.20.0`	`2.20.0`

Description

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

NVD description

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

References

nvd.nist.gov/vuln/detail/CVE-2018-18074 · ADVISORY
requests/requests · WEB
requests/requests#4718 · WEB
requests/requests commit c45d7c4 · WEB
access.redhat.com/errata/RHSA-2019:2035 · WEB
bugs.debian.org/910766 · WEB
pypa/advisory-database · WEB
requests/requests · PACKAGE
usn.ubuntu.com/3790-1 · WEB
usn.ubuntu.com/3790-2 · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
docs.python-requests.org/en/master/community/updates · WEB
lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html · WEB
usn.ubuntu.com/3790-1 · Third Party Advisory
usn.ubuntu.com/3790-2 · Third Party Advisory
GitHub Advisory GHSA-x84v-xcm2-53pg · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free