CVE-2018-18074

🗓️ 09 Oct 2018 15:00:00Reported by Debian Security Bug TrackerType

debiancve🔗 security-tracker.debian.org👁 36 Views

The Requests package for Python before 2.20.0 sends HTTP Authorization header to http URI upon receiving same-hostname https-to-http redirect, making it easier for attackers to discover credentials

Reporter	Title	Published	Views	Family All 203
FreeBSD	www/py-requests -- Information disclosure vulnerability	27 Jun 201800:00	–	freebsd
Huntr	Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects/follow-redirects	8 Feb 202202:23	–	huntr
Huntr	Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch	12 Feb 202217:07	–	huntr
GithubExploit	Exploit for Deserialization of Untrusted Data in Pyyaml	29 Aug 202510:27	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Automation is vulnerable to multiple security vulnerabilites	27 Mar 202617:49	–	ibm
Tenable Nessus	Amazon Linux 2 : python-requests (ALAS-2019-1334)	25 Oct 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)	24 Apr 202000:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0103: python-pip (ALINUX3-SA-2022:0103)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : python27:2.7 (CESA-2020:1605)	1 Feb 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	all	requests	2.20.0-1	requests_2.20.0-1_all.deb
Debian	12	all	requests	2.20.0-1	requests_2.20.0-1_all.deb
Debian	13	all	requests	2.20.0-1	requests_2.20.0-1_all.deb
Debian	14	all	requests	2.20.0-1	requests_2.20.0-1_all.deb
Debian	999	all	requests	2.20.0-1	requests_2.20.0-1_all.deb

09 Oct 2018 15:00Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.07443