Vulnerability advisory

CVE-2018-18074

Published Oct 9, 2018Updated Oct 20, 2026OSV record ↗

Also known as GHSA-x84v-xcm2-53pgPYSEC-2018-28

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/psf/requests ↗
All commits before bd840450c0d1e9db3bf62382c15d96378cc3a056	`bd840450c0d1e9db3bf62382c15d96378cc3a056`
Not specified	`c45d7c49ea75133e52ab22a8e9e13173938e36ff`
Also listed as affected (102) `v2.19.1` `v2.19.0` `v2.18.3` `v2.18.2` `v2.17.3` `v2.17.1` `v2.17.0` `v2.16.5` `v2.16.4` `v2.16.2` `v2.16.1` `v2.16.0` `v2.15.1` `v2.16.3` `v2.15.0` `v2.14.2` `v2.14.1` `v2.14.0` `v2.12.5` `v2.12.4` `v2.12.3` `v2.12.2` `v2.12.0` `v2.12.1` `v2.11.1` `v2.11.0` `v2.10.0` `v2.9.2` `v2.9.1` `v2.9.0` `v2.8.1` `v2.8.0` `v2.6.0` `v2.5.2` `v2.5.1` `v2.5.0` `v2.4.3` `v2.4.2` `v2.4.1` `v2.4.0` `v2.3.0` `v2.2.1` `v2.2.0` `v2.1.0` `v2.0.1` `v2.0.0` `v2.0` `2.0` `v1.2.3` `v1.2.2` `v1.2.1` `v1.2.0` `v1.1.0` `v1.0.4` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v0.14.2` `v0.14.0` `v0.14.1` `v0.13.9` `v0.13.7` `v0.13.6` `v0.13.5` `v0.13.4` `v0.13.3` `v0.13.2` `v0.13.1` `v0.13.0` `v0.12.1` `v0.12.0` `v0.11.1` `v0.10.8` `v0.10.7` `v0.10.6` `v0.10.5` `v0.10.4` `v0.10.3` `v0.10.2` `v0.10.1` `v0.10.0` `v0.9.3` `v0.9.1` `v0.9.0` `v0.8.9` `v0.8.8` `v0.6.4` `v0.6.3` `v0.5.1` `v0.5.0` `v0.4.1` `v0.4.0` `v0.3.4` `v0.3.3` `v0.3.2` `v0.3.0` `v0.2.4` `v0.2.3` `v0.2.2` `v0.2.1` `v0.2.0`

Description

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

CVE-2018-18074

Affected versions

Repository

Description

References