Skip to content
OpenAdvisories
Low ELSA-2019-2035 1 CVE

Low: python-requests security update (Oracle Linux 7)

Published Aug 13, 2019 · Updated Aug 13, 2019

Ecosystem: Oracle Linux

Summary

[2.6.0-5]
- Fix CVE-2018-18074
Resolves: rhbz#1647368

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 python-requests 0:2.6.0-5.el7

Vulnerabilities 1

  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI