Moderate Vulnerability in python-requests: Credentials Leak via Malicious URLs
Summary
RLSA-2025:13604: Moderate: python-requests security update. Affects python-requests versions < 0:2.32.4-1.el10_0. Fixed in 0:2.32.4-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-requests is a widely used library in Python for making HTTP requests simpler and more human-friendly. It provides an easy-to-use interface for sending HTTP requests, handling responses, and managing sessions. However, it has been found to be vulnerable to a specific issue where .netrc credentials can be leaked through malicious URLs, posing a risk to user security.
Vulnerability Detail
The vulnerability identified as CVE-2024-47081 allows for the potential leakage of .netrc credentials when users interact with malicious URLs. This can lead to unauthorized access to sensitive information, as the .netrc file may contain credentials for various services. The issue arises from how the requests library processes URLs, making it susceptible to exploitation by attackers. The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:2.32.4-1.el10_0
This is the first release that contains the fix.
sudo dnf update python-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using .netrc files or ensure that sensitive credentials are not stored in them while using the affected version of python-requests. Additionally, be cautious when clicking on links from untrusted sources.
Conclusion
The python-requests library has a moderate vulnerability that can lead to the leakage of sensitive credentials through malicious URLs. It is crucial to update to the patched version to mitigate this risk. Users should also be cautious with their usage of .netrc files and untrusted URLs until they can apply the necessary updates.
See every vulnerability recorded for python-requests →
FAQ
Python-requests is a library that simplifies making HTTP requests in Python, allowing developers to interact with web services easily.
CVE-2024-47081 refers to a specific vulnerability in the python-requests library that can lead to the leakage of .netrc credentials through malicious URLs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider avoiding the use of .netrc files and be cautious with URLs from untrusted sources as a temporary workaround.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk that requires attention.
Related vulnerabilities
Recent vulnerabilities recorded for python-requests.
