CVE-2024-47081 — Requests vulnerable to .netrc credentials leak via malicious URLs

Affected: psf requests

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

USN-7568-1 — requests vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: requests, Ubuntu:Pro:16.04:LTS: requests, Ubuntu:Pro:18.04:LTS: requests, Ubuntu:Pro:20.04:LTS: requests, Ubuntu:22.04:LTS: requests, Ubuntu:24.04:LTS: requests

Dennis Brinkrolf and Tobias Funke discovered that Requests did not correctly handle certain HTTP headers. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-32681)

Juho Forsén discovered that Requests did not correctly parse URLs. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2024-47081)

Most recent entries from all

CVE-2024-47081 — Requests vulnerable to .netrc credentials leak via malicious URLs

USN-7568-1 — requests vulnerabilities