GHSA-x84v-xcm2-53pg: Insufficiently Protected Credentials in Requests

Affected versions

requests PyPI

Affected Fixed in

All versions before 2.20.0 2.20.0Advisories →

Affected	Fixed in
All versions before 2.20.0	`2.20.0`Advisories →
Also listed as affected (134) `0.0.1` `0.10.0` `0.10.1` `0.10.2` `0.10.3` `0.10.4` `0.10.6` `0.10.7` `0.10.8` `0.11.1` `0.11.2` `0.12.0` `0.12.01` `0.12.1` `0.13.0` `0.13.1` `0.13.2` `0.13.3` `0.13.4` `0.13.5` `0.13.6` `0.13.7` `0.13.8` `0.13.9` `0.14.0` `0.14.1` `0.14.2` `0.2.0` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.3.0` `0.3.1` `0.3.2` `0.3.3` `0.3.4` `0.4.0` `0.4.1` `0.5.0` `0.5.1` `0.6.0` `0.6.1` `0.6.2` `0.6.3` `0.6.4` `0.6.5` `0.6.6` `0.7.0` `0.7.1` `0.7.2` `0.7.3` `0.7.4` `0.7.5` `0.7.6` `0.8.0` `0.8.1` `0.8.2` `0.8.3` `0.8.4` `0.8.5` `0.8.6` `0.8.7` `0.8.8` `0.8.9` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `2.0.0` `2.0.1` `2.1.0` `2.10.0` `2.11.0` `2.11.1` `2.12.0` `2.12.1` `2.12.2` `2.12.3` `2.12.4` `2.12.5` `2.13.0` `2.14.0` `2.14.1` `2.14.2` `2.15.0` `2.15.1` `2.16.0` `2.16.1` `2.16.2` `2.16.3` `2.16.4` `2.16.5` `2.17.0` `2.17.1` `2.17.2` `2.17.3` `2.18.0` `2.18.1` `2.18.2` `2.18.3` `2.18.4` `2.19.0` `2.19.1` `2.2.0` `2.2.1` `2.3.0` `2.4.0` `2.4.1` `2.4.2` `2.4.3` `2.5.0` `2.5.1` `2.5.2` `2.5.3` `2.6.0` `2.6.1` `2.6.2` `2.7.0` `2.8.0` `2.8.1` `2.9.0` `2.9.1` `2.9.2`

Also listed as affected (134)

0.0.1
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.6
0.10.7
0.10.8
0.11.1
0.11.2
0.12.0
0.12.01
0.12.1
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.13.8
0.13.9
0.14.0
0.14.1
0.14.2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
2.0.0
2.0.1
2.1.0
2.10.0
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.14.0
2.14.1
2.14.2
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.19.0
2.19.1
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2

Description

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

GHSA-x84v-xcm2-53pg

Affected versions

requests PyPI

Description

References