CVE-2024-35195: requests - subsequent requests to the same host ignore cert verification
Summary
CVE-2024-35195: Requests is a HTTP library. Affects py3-requests across 2 version ranges.
< 2.32.3-r0
< a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
Fixed in 2.32.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Requests is a popular HTTP library used for making HTTP requests in Python. It provides a convenient and user-friendly interface for sending HTTP requests and handling responses. The vulnerability identified as CVE-2024-35195 affects requests version 2.11.1. This vulnerability allows subsequent requests to the same host to ignore certificate verification, even if the verify parameter is changed. This behavior persists for the entire lifecycle of the connection in the connection pool.
Vulnerability Detail
The vulnerability arises when using the Requests Session object and making the first request with verify=False to disable certificate verification. After this initial request, all subsequent requests to the same host will continue to ignore certificate verification, regardless of any changes made to the verify parameter. This can lead to potential security risks as it allows for the possibility of establishing insecure connections without proper certificate validation. The vulnerability has been assigned a CVSS score of 5.6, indicating a medium severity level.
How To Fix
Minimum fixed version
2.32.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the fixed version is not immediately possible, it is recommended to create a new Session object for each request or to explicitly set verify=True for subsequent requests to ensure proper certificate verification. Here is an example of explicitly setting verify=True:
import requests
session = requests.Session()
# First request with verify=False
response = session.get('https://example.com', verify=False)
# Subsequent request with verify=True
response = session.get('https://example.com', verify=True)
Conclusion
The vulnerability in requests version 2.11.1 allows subsequent requests to the same host to ignore certificate verification, potentially leading to insecure connections. To mitigate this vulnerability, it is recommended to upgrade to requests version 2.32.0 or later. If immediate upgrade is not possible, using a new Session object for each request or explicitly setting verify=True for subsequent requests can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py3-requests →
FAQ
The vulnerability allows subsequent requests to the same host to ignore certificate verification, potentially leading to the establishment of insecure connections without proper certificate validation. This can expose sensitive data to eavesdropping or man-in-the-middle attacks.
The vulnerability affects requests version 2.11.1. Versions prior to 2.32.0 are vulnerable.
You can check the version of requests installed by running the following command in your Python environment: pip show requests.
Yes, the vulnerability has been assigned a CVSS score of 5.6, indicating a medium severity level.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2024-35195.
References
Related vulnerabilities
Recent vulnerabilities recorded for py3-requests.
