5.6 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%
When making requests through a Requests Session
, if the first request is made with verify=False
to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of verify
. This behavior will continue for the lifecycle of the connection in the connection pool.
Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.
requests>=2.32.0
.requests<2.32.0
, avoid setting verify=False
for the first request to a host while using a Requests Session.requests<2.32.0
, call close()
on Session
objects to clear existing connections if verify=False
is used.github.com/advisories/GHSA-9wx4-h78v-vm56
github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
github.com/psf/requests/pull/6655
github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
lists.fedoraproject.org/archives/list/[email protected]/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
lists.fedoraproject.org/archives/list/[email protected]/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ
nvd.nist.gov/vuln/detail/CVE-2024-35195
5.6 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%