Critical Security Update for python-requests and python3-requests in Red Hat OpenStack 17.1.4
Summary
RHSA-2024:9988: Red Hat Security Advisory: RHOSP 17.1.4 (python-requests) security update. Affects python-requests versions < 0:2.25.1-2.el8ost. Fixed in 0:2.25.1-2.el8ost. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-requests and python3-requests packages are essential libraries in the Red Hat OpenStack ecosystem, facilitating HTTP requests in a user-friendly manner. These libraries are widely used for making API calls and handling web communications, making them integral to many applications. However, a recently identified vulnerability poses a significant risk to systems utilizing these packages.
Vulnerability Detail
The vulnerability, identified as CVE-2024-35195, originates from a flaw in the python-requests and python3-requests libraries. This issue can lead to potential data exposure, allowing unauthorized access to sensitive information. The vulnerability has a CVSS score of 5.6, indicating a moderate severity level. If exploited, it could allow attackers to manipulate requests or responses, potentially leading to data leaks or unauthorized actions within the application.
How To Fix
Minimum fixed version
0:2.25.1-2.el8ost
This is the first release that contains the fix.
sudo dnf update python-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application by restricting access to the affected services or implementing additional authentication layers. However, this is not a permanent solution and updating the packages is highly recommended.
Conclusion
The identified vulnerability in python-requests and python3-requests poses a moderate risk to applications within the Red Hat OpenStack ecosystem. It is imperative to update to the patched versions to mitigate potential threats. Utilizing tools like Vulert can further enhance your security posture by providing ongoing monitoring for vulnerabilities.
See every vulnerability recorded for python-requests →
FAQ
CVE-2024-35195 is a security vulnerability affecting the python-requests and python3-requests libraries, which can lead to unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could result in data leaks, unauthorized access, and potential exploitation of your application by malicious actors.
Updating the packages to the patched versions should not result in data loss. However, it is always advisable to back up your data before performing updates.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file. It helps ensure your applications remain secure by providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for python-requests.
