Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2025-0012

Опубликовано: 02 янв. 2025
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2025-0012: python-requests security update (MODERATE)

[2.20.0-5]

  • Security fix for CVE-2024-35195 Resolves: RHEL-37605

[2.20.0-4]

  • Bump release to fix upgrade path from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8 Related: rhbz#2209469

[2.20.0-3]

  • Security fix for CVE-2023-32681 Resolves: rhbz#2209469

[2.20.0-2]

  • Properly handle default ports when stripping the authorization header Resolves: rhbz#1752799

[2.20.0-1]

  • Update to v2.20.0 for CVE-2018-18074.

[2.19.1-4]

[2.19.1-3]

  • Allow build with Python 2

[2.19.1-2]

  • Remove the python-pytest-cov dependency

[2.19.1-1]

  • Update to v2.19.1 (rhbz 1591531)

[2.19.0-1]

  • Update to v2.19.0 (rhbz 1590508)

[2.18.4-6]

  • Skip all tests needing httpbin: httpbin has too many dependencies to be shipped in RHEL just for build-time package tests

[2.18.4-5]

  • BR idna, or the tests fail to start

[2.18.4-4]

  • Stop injecting PyOpenSSL (rhbz 1567862)

[2.18.4-3]

[2.18.4-2]

[2.18.4-1]

  • Update to 2.18.4

[2.18.2-1]

  • Update to 2.18.2

[2.18.1-2]

  • Drop the dependency on certifi in setup.py

[2.18.1-1]

  • Update to 2.18.1 (#1449432)
  • Remove tests that require non-local network (#1450608)

[2.14.2-1]

  • Update to 2.14.2 (#1449432)
  • Switch to autosetup to apply patches

[2.13.0-2]

  • Don't run tests when building as a module

[2.13.0-1]

  • Update to 2.13.0 (#1418138)

[2.12.4-3]

  • Include and enable tests (now python-pytest-httpbin is packaged)

[2.12.4-2]

  • Rebuild for Python 3.6 again.

[2.12.4-1]

  • Update to 2.12.4. Fixes #1404680

[2.12.3-2]

  • Rebuild for Python 3.6

[2.12.3-1]

  • Update to 2.12.3. Fixes #1400601

[2.12.2-1]

  • Update to 2.12.2

[2.12.1-2]

  • Backport #3713. Fixes #1397149

[2.12.1-1]

  • Update to 2.12.1. Fixes #1395469
  • Unbundle idna, a new upstream dependency

[2.11.1-1]

  • Update to 2.11.1. Fixes #1370814

[2.11.0-1]

  • Update to 2.11.0. Fixes #1365332

[2.10.0-4]

[2.10.0-3]

  • Update python2 packaging.

[2.10.0-2]

  • Fix python2 subpackage to comply with guidelines.

[2.9.1-2]

[2.9.1-1]

  • new version

[2.9.0-1]

  • new version

[2.8.1-1]

  • Latest upstream.
  • Bump hard dep on urllib3 to 1.12.

[2.7.0-8]

  • Rebuilt for Python3.5 rebuild

[2.7.0-7]

[2.7.0-6]

  • Replace the provides macro with a plain provides field for now until we can re-organize this package into two different subpackages.

[2.7.0-5]

  • Remove 'provides: python2-requests' from the python3 subpackage, obviously.

[2.7.0-4]

  • Employ %python_provides macro to provide python2-requests.

[2.7.0-3]

[2.7.0-2]

[2.7.0-1]

  • new version

[2.6.2-1]

  • new version

[2.6.1-1]

  • new version

[2.6.0-1]

  • new version
  • Remove patch for CVE-2015-2296, now included in the upstream release.

[2.5.3-2]

  • Backport fix for CVE-2015-2296.

[2.5.3-1]

  • new version

[2.5.1-1]

  • new version

[2.5.0-3]

  • Pin python-urllib3 requirement at 1.10.
  • Fix requirement pinning syntax.

[2.5.0-2]

  • Do the most basic of tests in the check section.

[2.5.0-1]

  • Latest upstream, 2.5.0 for #1171068

[2.4.3-1]

  • Latest upstream, 2.4.3 for #1136283

[2.3.0-4]

  • Re-do unbundling by symlinking system libs into the requests/packages/ dir.

[2.3.0-3]

  • fix license handling

[2.3.0-2]

[2.3.0-1]

  • Latest upstream

[2.0.0-2]

[2.0.0-1]

  • Latest upstream.
  • Add doc macro to the python3 files section.
  • Require python-urllib3 greater than or at 1.7.1.

[1.2.3-5]

  • fix versioned dep on python-urllib3

[1.2.3-4]

  • Explicitly versioned the requirements on python-urllib3.

[1.2.3-3]

  • Release bump for a coupled update with python-urllib3.

[1.2.3-2]

[1.2.3-1]

  • Latest upstream.
  • Fixed bogus date in changelog.

[1.1.0-4]

  • Correct a rhel conditional on python-ordereddict

[1.1.0-3]

  • Unbundled python-urllib3. Using system python-urllib3 now.
  • Conditionally include python-ordereddict for el6.

[1.1.0-2]

  • Unbundled python-charade/chardet. Using system python-chardet now.
  • Removed deprecated comments and actions against oauthlib unbundling. Those are no longer necessary in 1.1.0.
  • Added links to bz tickets over Patch declarations.

[1.1.0-1]

  • Latest upstream.
  • Relicense to ASL 2.0 with upstream.
  • Removed cookie handling patch (fixed in upstream tarball).
  • Updated cert unbundling patch to match upstream.
  • Added check section, but left it commented out for koji.

[0.14.1-4]

[ 0.14.1-1]

  • Updated to latest upstream release

[0.13.1-1]

  • Updated to latest upstream release 0.13.1
  • Use system provided ca-certificates
  • No more async requests use grrequests https://github.com/kennethreitz/grequests
  • Remove gevent as it is no longer required by requests

[0.11.1-1]

  • Updated to upstream release 0.11.1

[0.10.6-3]

  • Support building package for EL6

[0.10.6-2]

  • +python3-requests pkg

[0.10.6-1]

  • Updated to new upstream version

[0.9.3-1]

  • Updated to new upstream version 0.9.3
  • Include python-gevent as a dependency for requests.async
  • Clean up shebangs in requests/setup.py,test_requests.py and test_requests_ext.py

[0.8.2-2]

[0.8.2-1]

  • New upstream version
  • keep alive support
  • complete removal of cookiejar and urllib2

[0.7.6-1]

  • Updated to new upstream release 0.7.6

[0.6.6-1]

  • Updated to version 0.6.6

[0.6.1-1]

  • Updated to version 0.6.1

[0.6.0-1]

  • Updated to latest version 0.6.0

[0.5.1-2]

  • Remove OPT_FLAGS from build section since it is a noarch package
  • Fix use of mixed tabs and space
  • Remove extra space around the word cumbersome in description

[0.5.1-1]

  • Initial package

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

python3-requests

2.20.0-5.el8_10

Oracle Linux x86_64

python3-requests

2.20.0-5.el8_10

Связанные CVE

Связанные уязвимости

CVSS3: 5.6
ubuntu
около 1 года назад

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

CVSS3: 5.6
redhat
около 1 года назад

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

CVSS3: 5.6
nvd
около 1 года назад

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

CVSS3: 5.6
msrc
около 1 года назад

Описание отсутствует

CVSS3: 5.6
debian
около 1 года назад

Requests is a HTTP library. Prior to 2.32.0, when making requests thro ...

Уязвимость ELSA-2025-0012