Moderate Security Vulnerability in python-requests: Cert Verification Bypass
Summary
ALSA-2025:0012: Moderate: python-requests security update. Affects python3-requests versions < 2.20.0-5.el8_10. Fixed in 2.20.0-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-requests is a widely used HTTP library for Python that simplifies making HTTP requests. It provides a user-friendly interface for sending HTTP requests and handling responses, making it a popular choice among developers for web scraping, API interactions, and more. However, the library has been found to have a security vulnerability that affects its ability to verify SSL certificates during subsequent requests to the same host, potentially exposing users to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability identified as CVE-2024-35195 allows subsequent requests to the same host to ignore SSL certificate verification. This flaw originates from improper handling of SSL context in the requests library, which can lead to security risks such as data interception or manipulation by malicious actors. The impact of this vulnerability is significant, as it undermines the fundamental security provided by HTTPS, potentially allowing attackers to impersonate legitimate servers and capture sensitive information.
How To Fix
Minimum fixed version
2.20.0-5.el8_10
This is the first release that contains the fix.
sudo dnf update python3-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually verify SSL certificates in your application code by setting the 'verify' parameter to 'True' in your requests. For example:
import requests response = requests.get('https://example.com', verify=True)
This will enforce SSL certificate verification until you can update the package.
Conclusion
The python-requests library has a moderate security vulnerability that can compromise SSL certificate verification. It is crucial to update to the latest patched version to mitigate risks associated with this vulnerability. Implementing workarounds can provide temporary relief, but updating the package is the best long-term solution.
See every vulnerability recorded for python3-requests →
FAQ
CVE-2024-35195 is a security vulnerability in the python-requests library that allows subsequent requests to the same host to bypass SSL certificate verification.
This vulnerability can expose your application to man-in-the-middle attacks, where an attacker could intercept and manipulate data transmitted between your application and the server.
If you cannot update the package right away, implement a workaround by manually verifying SSL certificates in your requests until you can apply the update.
More information can be found on the CVE page associated with CVE-2024-35195, which provides detailed insights into the vulnerability and its implications.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for python3-requests.
