Описание
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on one's Requests Session.
A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue.
Отчет
Moderate impact: The Requests HTTP library used in affected Red Hat products can leak .netrc credentials to a third party when a client processes a maliciously crafted URL because of a URL-parsing flaw. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), reflecting a network-reachable attack requiring high complexity and user interaction, with confidentiality impact only. The current affects include Red Hat AI Inference Server, Red Hat OpenShift AI, OpenShift Container Platform, Red Hat Satellite, Red Hat Enterprise Linux, and other Red Hat products; fixes are recorded as deferred for most affected product streams, and the current record does not provide a product-specific rationale for that deferral. Until remediated, the residual risk is disclosure of .netrc credentials under the described conditions. For delegated affects, remediation is being pursued through the delegated resolution path; some other affects are recorded as OOSS or WONTFIX. Forty-one Red Hat Enterprise Linux affects are not affected because the vulnerable code is not in the execute path, while two additional RHEL affects are new.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-agent-rhel9 | Fix deferred | ||
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-controller-rhel9 | Fix deferred | ||
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Fix deferred | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-shared-resource-rhel9 | Fix deferred | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-shared-resource-webhook-rhel9 | Fix deferred | ||
| Confidential Compute Attestation | confidential-compute-attestation-tech-preview/trustee-rhel9 | Fix deferred | ||
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle | Fix deferred | ||
| Multiarch Tuning Operator | multiarch-tuning/multiarch-tuning-rhel9-operator | Fix deferred | ||
| Network Observability Operator | network-observability/network-observability-cli-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-istio-controller-rhel8 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Due to a URL parsing issue, Requests relea ...
EPSS
5.3 Medium
CVSS3