Insecure Certificate Verification in Requests Library - CVE-2024-35195
Summary
DEBIAN-CVE-2024-35195: Requests is a HTTP library. Affects requests versions < 2.32.3+dfsg-1. Fixed in 2.32.3+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Requests library is a widely used HTTP library for Python, designed to simplify making HTTP requests. It provides a user-friendly interface for sending HTTP requests, handling responses, and managing sessions. However, prior to version 2.32.0, the library exhibited a critical vulnerability related to certificate verification, which could lead to security risks when communicating with servers over HTTPS.
Vulnerability Detail
The vulnerability arises when a user makes an initial request with the 'verify=False' option to disable SSL certificate verification. In this scenario, all subsequent requests to the same host will continue to ignore certificate verification, regardless of any changes made to the 'verify' parameter. This behavior persists for the entire lifecycle of the connection in the connection pool, potentially exposing users to man-in-the-middle attacks and other security threats. The issue was identified in versions prior to 2.32.0 and has been addressed in version 2.32.0.
How To Fix
Minimum fixed version
2.32.3+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using 'verify=False' in their requests. Instead, ensure that SSL certificate verification is enabled by either omitting the 'verify' parameter or setting it to 'True'. This will help mitigate the risk until the library is updated.
Conclusion
The Requests library vulnerability CVE-2024-35195 poses significant security risks by allowing insecure SSL certificate verification. Users are strongly advised to update to the latest version to protect their applications from potential attacks. Implementing best practices for SSL verification will further enhance security.
See every vulnerability recorded for requests →
FAQ
CVE-2024-35195 is a vulnerability in the Requests library that allows subsequent requests to ignore SSL certificate verification if the first request is made with 'verify=False'.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The main risk is exposure to man-in-the-middle attacks, where an attacker can intercept and manipulate data transmitted between the client and server.
Yes, avoid using 'verify=False' in your requests to ensure that SSL certificate verification is enforced.
You can update the Requests library by running 'sudo apt-get update && sudo apt-get install requests' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
