CVE-2018-18074: Requests package sends HTTP Authorization header to an HTTP URI upon receiving a same-hostname HTTPS-to-HTTP redirect
Summary
CVE-2018-18074: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by... Affects requests across 2 version ranges.
< 2.20.0-1
< c45d7c49ea75133e52ab22a8e9e13173938e36ff
Fixed in 2.20.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Requests package is a popular Python library used for making HTTP requests. It provides a simple and convenient way to interact with web services. The package is widely used in various applications and frameworks. However, prior to version 2.20.0, the package had a vulnerability that allowed it to send an HTTP Authorization header to an HTTP URI when it received a same-hostname HTTPS-to-HTTP redirect. This behavior could potentially expose credentials to remote attackers who can sniff the network traffic.
Vulnerability Detail
The vulnerability (CVE-2018-18074) in the Requests package arises from its incorrect handling of same-hostname HTTPS-to-HTTP redirects. When the package encounters such a redirect, it sends an HTTP Authorization header to the HTTP URI. This behavior can be exploited by attackers who have the ability to intercept network traffic. By sniffing the network, they can discover credentials that are sent in the Authorization header. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
2.20.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Requests package (CVE-2018-18074) allows for potential exposure of credentials through network sniffing. It is crucial to upgrade to version 2.20.0-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote attackers to potentially discover credentials by sniffing network traffic.
Versions prior to 2.20.0-1 are affected.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can find more information about this vulnerability in the CVE-2018-18074 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18074.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
