requests 2.20.0 vulnerabilities

8 advisories known · requests@2.20.0 · 4 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 2.20.0

SEVERITYADVISORYPUBLISHED

MediumUnintended leak of Proxy-Authorization header in requestsGHSA-j8r2-6x86-q33qCVE-2023-32681PYSEC-2023-74Affected >=2.3.0 <2.31.0Fixed in 2.31.0OSV source ↗3 years ago

MediumRequests `Session` object does not verify requests after making first request with verify=FalseGHSA-9wx4-h78v-vm56CVE-2024-35195PYSEC-2026-1873Affected <2.32.0Fixed in 2.32.0OSV source ↗4 months ago

MediumRequests vulnerable to .netrc credentials leak via malicious URLsGHSA-9hjg-9r4m-mvj7CVE-2024-47081PYSEC-2026-1872Affected <2.32.4Fixed in 2.32.4OSV source ↗4 months ago

MediumRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionGHSA-gc5v-m9x4-r6x2CVE-2026-25645PYSEC-2026-2275Affected <2.33.0Fixed in 2.33.0OSV source ↗8 months ago

Does not affect 2.20.0

SEVERITYADVISORYPUBLISHED

HighInsufficiently Protected Credentials in RequestsGHSA-x84v-xcm2-53pgCVE-2018-18074PYSEC-2018-28Affected <2.20.0Fixed in 2.20.0OSV source ↗8 years ago

MediumExposure of Sensitive Information to an Unauthorized Actor in RequestsGHSA-652x-xj99-gmccCVE-2014-1830PYSEC-2014-14Affected <2.3.0Fixed in 2.3.0OSV source ↗4 years ago

MediumPython Requests Session FixationGHSA-pg2w-x9wp-vw92CVE-2015-2296PYSEC-2015-17Affected >=2.1.0 <2.6.0, 0.2.0 - 0.3.0, 0.3.2 - 0.5.1, 0.6.3 - 0.6.4, 0.8.8 - 0.9.1, 0.9.3 - 0.11.1, 0.12.0 - 0.13.7, 0.13.9 - 2.0.1, ==v0.10.5Fixed in 2.6.0OSV source ↗4 years ago

MediumExposure of Sensitive Information to an Unauthorized Actor in RequestsGHSA-cfj3-7x9c-4p3hCVE-2014-1829PYSEC-2014-13Affected <2.3.0Fixed in 2.3.0OSV source ↗12 years ago