Moderate Vulnerability in python-requests: Cert Verification Bypass
Summary
RLSA-2025:7049: Moderate: python-requests security update. Affects python-requests versions < 0:2.25.1-9.el9. Fixed in 0:2.25.1-9.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-requests is a popular HTTP library for Python, designed to simplify making HTTP requests. It provides a user-friendly interface for sending HTTP requests and handling responses, including support for sessions, cookies, and authentication. However, a recent vulnerability has been identified that affects the library's certificate verification process, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2024-35195, allows subsequent requests to the same host to ignore certificate verification. This flaw can lead to man-in-the-middle attacks, where an attacker could intercept and modify the data being transmitted between the client and server without detection. The issue arises from improper handling of SSL certificates, which are crucial for establishing secure connections. The CVSS score for this vulnerability is 5.6, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:2.25.1-9.el9
This is the first release that contains the fix.
sudo dnf update python-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify SSL certificates in their requests by setting the 'verify' parameter to 'True' in their request calls. For example:
import requests response = requests.get('https://example.com', verify=True)
Conclusion
The python-requests library has a moderate vulnerability that could compromise secure communications due to improper SSL certificate verification. Users are strongly advised to update to the patched version to mitigate risks. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for python-requests →
FAQ
CVE-2024-35195 is a vulnerability in the python-requests library that allows subsequent requests to the same host to ignore SSL certificate verification.
The primary risk is the potential for man-in-the-middle attacks, where an attacker could intercept and alter data being transmitted without detection.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider implementing manual SSL certificate verification in your requests as a temporary workaround.
For more details, refer to the CVE page associated with CVE-2024-35195 and the Rocky Linux 9 Release Notes.
Related vulnerabilities
Recent vulnerabilities recorded for python-requests.
