VDB
PYSEC-2018-28
PYSEC-2018-28
PUBLISHED
Record from OSV · Published October 9, 2018
requests is fixed in c45d7c49ea75133e52ab22a8e9e13173938e36ff and 2.20.0 (PyPI)
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| requests | PyPI | c45d7c49ea75133e52ab22a8e9e13173938e36ff, 2.20.0 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | requests | 0.14.1, 0, 0 |
Timeline
- Oct 9, 2018 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2018-28
vulnetix vdb fixes PYSEC-2018-28Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2018-28/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html url
- https://github.com/advisories/GHSA-x84v-xcm2-53pg advisory
- https://github.com/requests/requests/pull/4718 fix
- https://usn.ubuntu.com/3790-2/ advisory
- https://github.com/requests/requests/issues/4716 report
- https://bugs.debian.org/910766 url
- http://docs.python-requests.org/en/master/community/updates/#release-and-version-history url
- https://access.redhat.com/errata/RHSA-2019:2035 advisory
- https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff patch
- https://usn.ubuntu.com/3790-1/ url