https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:10:34 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:0012 <p><strong>Affected:</strong> AlmaLinux:8: python3-requests</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* requests: subsequent requests to the same host ignore cert verification (CVE-2024-35195)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: python3-requests</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* requests: subsequent requests to the same host ignore cert verification (CVE-2024-35195)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:0012 https://cve.radiocsirt.org/vuln/bdu:2024-07014 bdu:2024-07014 https://cve.radiocsirt.org/vuln/bdu:2024-07014 https://cve.radiocsirt.org/vuln/bell-cve-2024-35195 <p><strong>Affected:</strong> Alpaquita:23: py3-requests, Alpaquita:stream: py3-requests</p> <p><strong>Affected:</strong> Alpaquita:23: py3-requests, Alpaquita:stream: py3-requests</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-35195 https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2024-35195 <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2024-35195 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/cleanstart-2026-dd95169 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: k8s-sidecar</p> <p>Multiple security vulnerabilities affect the k8s-sidecar package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: k8s-sidecar</p> <p>Multiple security vulnerabilities affect the k8s-sidecar package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-dd95169 https://cve.radiocsirt.org/vuln/euvd-2026-248759 EUVD-2026-248759 https://cve.radiocsirt.org/vuln/euvd-2026-248759 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35195 <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-35195 https://cve.radiocsirt.org/vuln/ghsa-9wx4-h78v-vm56 <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> https://cve.radiocsirt.org/vuln/ghsa-9wx4-h78v-vm56 https://cve.radiocsirt.org/vuln/msrc_cve-2024-35195 msrc_CVE-2024-35195 https://cve.radiocsirt.org/vuln/msrc_cve-2024-35195 https://cve.radiocsirt.org/vuln/oesa-2025-2806 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-requests</p> <p>Requests is an HTTP library, written in Python, as an alternative to Python&amp;amp;apos;s builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. + Multipart File Uploads. + CookieJar Support. + Redirection History. + Redirection Recursion Urllib Fix. + Automatic Decompression of GZipped Content. + Unicode URL Support. - Authentication: + URL + HTTP Auth Registry. Security Fix(es):</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.(CVE-2024-35195)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-requests</p> <p>Requests is an HTTP library, written in Python, as an alternative to Python&amp;amp;apos;s builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. + Multipart File Uploads. + CookieJar Support. + Redirection History. + Redirection Recursion Urllib Fix. + Automatic Decompression of GZipped Content. + Unicode URL Support. - Authentication: + URL + HTTP Auth Registry. Security Fix(es):</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.(CVE-2024-35195)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2806 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13999-1 <p>python310-requests-2.32.2-1.1 on GA media</p> <p>python310-requests-2.32.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13999-1 https://cve.radiocsirt.org/vuln/pysec-2026-1873 <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1873 https://cve.radiocsirt.org/vuln/rhea-2024:4071 <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools jsonata: malicious expression can pollute the &#34;Object&#34; prototype jinja2: accepts keys containing non-attribute characters requests: subsequent requests to the same host ignore cert verification</p> <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools jsonata: malicious expression can pollute the &#34;Object&#34; prototype jinja2: accepts keys containing non-attribute characters requests: subsequent requests to the same host ignore cert verification</p> https://cve.radiocsirt.org/vuln/rhea-2024:4071 https://cve.radiocsirt.org/vuln/suse-ru-2024:3598-1 <p>Recommended update for python-requests</p> <p>Recommended update for python-requests</p> https://cve.radiocsirt.org/vuln/suse-ru-2024:3598-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35195 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: requests, Ubuntu:Pro:16.04:LTS: requests, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: requests, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: requests, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: requests, Ubuntu:Pro:22.04:LTS: python-pip and 2 more</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: requests, Ubuntu:Pro:16.04:LTS: requests, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: requests, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: requests, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: requests, Ubuntu:Pro:22.04:LTS: python-pip and 2 more</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35195 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1328 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1328