High USN-3790-1 1 CVE

requests vulnerability

Published Oct 15, 2018 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Requests incorrectly handled certain HTTP headers.
An attacker could possibly use this issue to access sensitive information.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	requests	2.2.1-1ubuntu0.4
Ubuntu · 16.04 LTS 16.04:LTS	requests	2.9.1-3ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS	requests	2.18.4-2ubuntu0.1

Vulnerabilities 1

High 7.5

CVE-2018-18074 Public exploit

Insufficiently Protected Credentials in Requests

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

python-pip requests requests requests Debian Ubuntu PyPI

Oct 9, 2018

References

report
https://ubuntu.com/security/CVE-2018-18074