Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2018-18074

Good to know:

icon
icon

Date: October 9, 2018

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Language: Python

Severity Score

Related Resources (21)

https://access.redhat.com/errata/RHSA-2019:2035
https://bugs.debian.org/910766
https://github.com/requests/requests/pull/4718
https://usn.ubuntu.com/3790-2/
https://usn.ubuntu.com/3790-2
https://usn.ubuntu.com/3790-1
https://usn.ubuntu.com/3790-1/
https://github.com/requests/requests
https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml
https://github.com/advisories/GHSA-x84v-xcm2-53pg
https://nvd.nist.gov/vuln/detail/CVE-2018-18074
https://github.com/requests/requests/issues/4716
http://docs.python-requests.org/en/master/community/updates/#release-and-version-history
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html
https://access.redhat.com/security/cve/CVE-2018-18074
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff
https://www.mend.io/resources/blog/top-security-open-source-vulnerabilities
https://www.mend.io/resources/blog/top-5-new-open-source-security-vulnerabilities-in-october-2018
https://www.mend.io/vulnerability-database/CVE-2018-18074
https://www.mend.io/resources/blog/top-10-open-source-vulnerabilities-of-2018

Severity Score

Weakness Type (CWE)

Credentials Management

CWE-255

Insufficiently Protected Credentials

CWE-522

Top Fix

icon

Upgrade Version

Upgrade to version 2.20.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us