CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
15.5%
Requests is vulnerable to Improper Certificate Validation. The vulnerability is due to a flaw where disabling certificate verification (verify=False
) in the first request of a Session
causes all subsequent requests to the same origin to ignore certificate verification, regardless of changes to the verify
setting. This behavior will continue for the lifecycle of the connection in the connection pool.
github.com/advisories/GHSA-9wx4-h78v-vm56
github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
github.com/psf/requests/pull/6655
github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
lists.fedoraproject.org/archives/list/[email protected]/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/
lists.fedoraproject.org/archives/list/[email protected]/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/