Security Update for requests Package
Summary
DSA-3146-1: requests - security update. Affects requests versions < 0.12.1-1+deb7u1. Fixed in 0.12.1-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The requests package is an HTTP library for the Python language. It provides a simple and intuitive way to make HTTP requests, handle cookies, and manage authentication. The package is widely used in various Python applications and frameworks to interact with web services and APIs.
Vulnerability Detail
The vulnerability discovered in the requests package allows remote servers to obtain sensitive information when a redirect occurs. Specifically, it mishandles authentication information, leading to the potential exposure of proxy passwords from the Proxy-Authorization header (CVE-2014-1830) or netrc passwords from the Authorization header (CVE-2014-1829). This can result in unauthorized access to protected resources and compromise the security of the affected systems.
How To Fix
Minimum fixed version
0.12.1-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The requests package has been found to have a vulnerability that mishandles authentication information during redirects. This can lead to the exposure of sensitive data, such as proxy passwords or netrc passwords. It is crucial to upgrade to the fixed versions to ensure the security of the affected systems. For additional support, please reach out to DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote servers to obtain sensitive information, potentially leading to unauthorized access and compromise of the affected systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No specific workarounds have been provided for this vulnerability. It is recommended to upgrade the requests package to the fixed versions.
Yes, the vulnerability affects versions prior to 0.12.1-1+deb7u1 for the stable distribution (wheezy).
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for requests.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
