VDB

ALINUX2-SA-2019%3A0090

ALINUX2-SA-2019%3A0090 PUBLISHED CVSS 2.5999999046325684 LOW

Package updates are available for Alibaba Cloud Linux 2.1903 that fix the following vulnerabilities: CVE-2018-18074: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Risk Scores

CVSS 3.0
2.5999999046325684
CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
Alibaba Cloudpython-requests

Timeline

  • Oct 10, 2019 CVE Published
  • Oct 10, 2019 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›