Em resumo
- CVE-2018-18074 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta requests, requests (python).
- Chance de exploração nos próximos 30 dias (EPSS): 6.9%, maior que 94.1% das vulnerabilidades.
- Correção: atualize para 2.20.0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| requests PyPI | < 2.20.0
| 2.20.0
|
| requests | < 2.20.0
| 2.20.0
|
Description
The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
NVD description
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free