GHSA-x84v-xcm2-53pg CVE-2018-18074 PYSEC-2018-28
Insufficiently Protected Credentials in Requests
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 6.93%
- Chance of exploitation in the next 30 days. Higher than 94.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-522 Insufficiently Protected Credentials
- Fix
2.20.0- Upgrade requests to this version or later
Description
The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
requests PyPI → 2.20.0
- pip
pip install --upgrade "requests>=2.20.0"- poetry
poetry add "requests>=2.20.0"- uv
uv add "requests>=2.20.0"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Packages
Other links
- github.com/requests/requests/issues/4716
- github.com/requests/requests/pull/4718
- github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff
- access.redhat.com/errata/RHSA-2019:2035
- bugs.debian.org/910766
- github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml
- usn.ubuntu.com/3790-1
- usn.ubuntu.com/3790-2
- oracle.com/security-alerts/cpujul2022.html
- docs.python-requests.org/en/master/community/updates
- lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html
- usn.ubuntu.com/3790-1
- usn.ubuntu.com/3790-2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function | Medium | Also affects requests |
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs | Medium | Also affects requests |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False | Medium | Also affects requests |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests | Medium | Also affects requests |
| GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation | Medium | Also affects requests |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | Not rated yet | Same weakness, CWE-522 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor