ALT-PU-2018-3708-1

Package update python-module-requests in branch sisyphus

Version2.21.0-alt1

Published2018-12-24

Max severityCRITICAL

Severity:

Closed issues (3)

CRITICAL9.8

Уязвимость библиотеки HTTP запросов языка программирования Python Requests, связанная с недостатком механизма хранения регистрационных данных, позволяющая нарушителю получить доступ к конфиденциальным данным

Published: 2021-03-21Modified: 2021-03-23

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N

References

CVE-2018-18074

HIGH7.5

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Published: 2018-10-09Modified: 2024-11-21

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA-x84v-xcm2-53pg

HIGH7.5

Insufficiently Protected Credentials in Requests

Published: 2018-10-29Modified: 2024-10-22

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References