Skip to content
OpenAdvisories
Low ALAS2-2019-1334 1 CVE

Low: python-requests security update (Amazon Linux 2)

Published Oct 21, 2019 · Updated Oct 23, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-18074: A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials. 99999: CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python-requests 0:2.6.0-7.amzn2

Vulnerabilities 1

  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-18074.html