python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

🗓️ 12 May 2020 18:59:30Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Flaw in python requests leaves Authorization header on HTTPS to HTTP redirects on the same host, exposing credentials.

Reporter	Title	Published	Views	Family All 205
FreeBSD	www/py-requests -- Information disclosure vulnerability	27 Jun 201800:00	–	freebsd
Huntr	Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects/follow-redirects	8 Feb 202202:23	–	huntr
Huntr	Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch	12 Feb 202217:07	–	huntr
GithubExploit	Exploit for Deserialization of Untrusted Data in Pyyaml	29 Aug 202510:27	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Automation is vulnerable to multiple security vulnerabilites	27 Mar 202617:49	–	ibm
Tenable Nessus	Amazon Linux 2 : python-requests (ALAS-2019-1334)	25 Oct 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)	24 Apr 202000:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0103: python-pip (ALINUX3-SA-2022:0103)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : python27:2.7 (CESA-2020:1605)	1 Feb 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	any	python3-pip	0:9.0.3-7.el7_8	python3-pip-0:9.0.3-7.el7_8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-18074
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-18074
cve	www.cve.org/CVERecord

26 Feb 2026 20:45Current

7.1High risk

Vulners AI Score7.1

CVSS 25

CVSS 3.17.5

EPSS0.07443

python requests authorization header secure to unencrypted redirects same host credentials exposure