Insufficiently Protected Credentials in Requests

CAO 7.5CVE-2018-18074 · GHSA-x84v-xcm2-53pg · PYSEC-2018-28 · Công bố 09/10/2018 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
requests PyPI	`< 2.20.0`	`2.20.0`
requests python	`< 2.20.0`	`2.20.0`

Mô tả

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Mô tả của NVD

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2018-18074 · ADVISORY
requests/requests · WEB
requests/requests#4718 · WEB
requests/requests commit c45d7c4 · WEB
access.redhat.com/errata/RHSA-2019:2035 · WEB
bugs.debian.org/910766 · WEB
pypa/advisory-database · WEB
requests/requests · PACKAGE
usn.ubuntu.com/3790-1 · WEB
usn.ubuntu.com/3790-2 · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
docs.python-requests.org/en/master/community/updates · WEB
lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html · WEB
usn.ubuntu.com/3790-1 · Third Party Advisory
usn.ubuntu.com/3790-2 · Third Party Advisory
GitHub Advisory GHSA-x84v-xcm2-53pg · ADVISORY

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí