Vulnerability advisory

PYSEC-2018-28

Published Oct 9, 2018Updated Nov 8, 2023OSV record ↗

Also known as CVE-2018-18074GHSA-x84v-xcm2-53pg

Severity

Severity not reported.

Affected versions

requests PyPI

Affected	Fixed
GIT github.com/requests/requests ↗
All commits before c45d7c49ea75133e52ab22a8e9e13173938e36ff	Commit `c45d7c49ea75133e52ab22a8e9e13173938e36ff`
All versions before 2.20.0	`2.20.0`Advisories →
Also listed as affected (134) `0.0.1` `0.10.0` `0.10.1` `0.10.2` `0.10.3` `0.10.4` `0.10.6` `0.10.7` `0.10.8` `0.11.1` `0.11.2` `0.12.0` `0.12.01` `0.12.1` `0.13.0` `0.13.1` `0.13.2` `0.13.3` `0.13.4` `0.13.5` `0.13.6` `0.13.7` `0.13.8` `0.13.9` `0.14.0` `0.14.1` `0.14.2` `0.2.0` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.3.0` `0.3.1` `0.3.2` `0.3.3` `0.3.4` `0.4.0` `0.4.1` `0.5.0` `0.5.1` `0.6.0` `0.6.1` `0.6.2` `0.6.3` `0.6.4` `0.6.5` `0.6.6` `0.7.0` `0.7.1` `0.7.2` `0.7.3` `0.7.4` `0.7.5` `0.7.6` `0.8.0` `0.8.1` `0.8.2` `0.8.3` `0.8.4` `0.8.5` `0.8.6` `0.8.7` `0.8.8` `0.8.9` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `2.0.0` `2.0.1` `2.1.0` `2.10.0` `2.11.0` `2.11.1` `2.12.0` `2.12.1` `2.12.2` `2.12.3` `2.12.4` `2.12.5` `2.13.0` `2.14.0` `2.14.1` `2.14.2` `2.15.0` `2.15.1` `2.16.0` `2.16.1` `2.16.2` `2.16.3` `2.16.4` `2.16.5` `2.17.0` `2.17.1` `2.17.2` `2.17.3` `2.18.0` `2.18.1` `2.18.2` `2.18.3` `2.18.4` `2.19.0` `2.19.1` `2.2.0` `2.2.1` `2.3.0` `2.4.0` `2.4.1` `2.4.2` `2.4.3` `2.5.0` `2.5.1` `2.5.2` `2.5.3` `2.6.0` `2.6.1` `2.6.2` `2.7.0` `2.8.0` `2.8.1` `2.9.0` `2.9.1` `2.9.2`

Description

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

PYSEC-2018-28

Affected versions

requests PyPI

Description

References