Security Vulnerability in python3-requests: .netrc Credentials Leak via Malicious URLs
Summary
ALSA-2025:13234: Moderate: python-requests security update. Affects python3-requests versions < 2.20.0-6.el8_10. Fixed in 2.20.0-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python3-requests is a popular HTTP library for Python that simplifies making HTTP requests. It is widely used for its ease of use and flexibility, allowing developers to send HTTP requests with minimal code. However, it has been identified that certain versions of this library are vulnerable to a security issue that can lead to the leakage of sensitive .netrc credentials when interacting with malicious URLs.
Vulnerability Detail
The vulnerability, identified as CVE-2024-47081, allows attackers to exploit the python3-requests library by crafting malicious URLs that can extract .netrc credentials from the user's environment. This could lead to unauthorized access to sensitive information, as .netrc files often contain usernames and passwords for various services. The issue arises from improper handling of credentials in specific scenarios, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.20.0-6.el8_10
This is the first release that contains the fix.
sudo dnf update python3-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using .netrc files or ensure that sensitive credentials are not stored in them while interacting with potentially untrusted URLs. Additionally, consider using environment variables or secure vaults for managing sensitive information.
Conclusion
The python3-requests library has a critical vulnerability that can lead to the leakage of sensitive credentials. Users are strongly advised to update to the latest patched version to mitigate this risk. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for python3-requests →
FAQ
The impact includes potential unauthorized access to sensitive credentials stored in .netrc files, which could lead to further exploitation of user accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as avoiding the use of .netrc files or using alternative methods for credential management.
No, this vulnerability is present in versions prior to 2.20.0-6.el8_10. Updating to the latest version will mitigate the risk.
More information can be found on the CVE page for CVE-2024-47081, which details the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for python3-requests.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
