CVE-2018-18074

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Affected products

Almalinux, Centos, Red Hat, Requests, Rocky Linux, Suse, Ubuntu

Python Requests

< 2.20.0

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

7.4% (94th percentile)

Weakness

CWE-522

NVD status

Modified

Published

2018-10-09