Описание
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Certification for Red Hat Enterprise Linux 8 | redhat-certification-baremetal-container | Will not fix | ||
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | redhat-certification | Will not fix | ||
| Red Hat Developer Hub | rhdh-operator-container | Not affected | ||
| Red Hat Discovery 1 | discovery-server-container | Not affected | ||
| Red Hat Enterprise Linux 10 | python-pip | Not affected | ||
| Red Hat Enterprise Linux 10 | python-requests | Affected | ||
| Red Hat Enterprise Linux 10 | python-tornado | Not affected | ||
| Red Hat Enterprise Linux 6 | python-requests | Out of support scope | ||
| Red Hat Enterprise Linux 7 | pykickstart | Out of support scope | ||
| Red Hat Enterprise Linux 7 | python-pip | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Requests `Session` object does not verify requests after making first request with verify=False
Requests is a HTTP library. Prior to 2.32.0, when making requests thro ...
EPSS
5.6 Medium
CVSS3