Moderate Vulnerability in python-requests: Credentials Leak via Malicious URLs
Summary
RLSA-2025:12519: Moderate: python-requests security update. Affects python-requests versions < 0:2.25.1-10.el9_6. Fixed in 0:2.25.1-10.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-requests is a popular HTTP library for Python, designed to simplify the process of making HTTP requests. It provides a user-friendly interface for sending HTTP requests and handling responses, making it a staple in many Python applications. However, a recent vulnerability has been identified that could lead to the exposure of sensitive credentials stored in the .netrc file when interacting with malicious URLs.
Vulnerability Detail
The vulnerability, identified as CVE-2024-47081, allows an attacker to exploit the python-requests library by crafting malicious URLs that can leak .netrc credentials. This could lead to unauthorized access to sensitive information, as the .netrc file often contains usernames and passwords for various services. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level. The risk is particularly pronounced in applications that utilize the requests library to handle user authentication or sensitive data.
How To Fix
Minimum fixed version
0:2.25.1-10.el9_6
This is the first release that contains the fix.
sudo dnf update python-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the .netrc file for storing credentials when making requests through the python-requests library. Instead, consider using environment variables or secure vaults to manage sensitive information.
Conclusion
The python-requests library has a moderate vulnerability (CVE-2024-47081) that can lead to the leakage of sensitive credentials. It is crucial to update to the patched version to mitigate this risk. Users should also consider alternative methods for managing credentials in the interim.
See every vulnerability recorded for python-requests →
FAQ
Python-requests is a library that simplifies making HTTP requests in Python, allowing developers to easily send requests and handle responses.
CVE-2024-47081 refers to a specific vulnerability in the python-requests library that can lead to the leakage of .netrc credentials through malicious URLs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If you cannot update the package immediately, consider using environment variables or secure vaults to manage sensitive information instead of relying on the .netrc file.
Related vulnerabilities
Recent vulnerabilities recorded for python-requests.
