PyPI/requests CVE-2018-18074: high 7.5, EPSS 6.93%

Insufficiently Protected Credentials in Requests

Action: Upgrade requests to 2.20.0 or later.

pip install requests==2.20.0

Affected

Fixed versions

Sources

• osv: GHSA-x84v-xcm2-53pg
• https://nvd.nist.gov/vuln/detail/CVE-2018-18074
• https://github.com/requests/requests/issues/4716
• https://github.com/requests/requests/pull/4718
• https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff
• https://access.redhat.com/errata/RHSA-2019:2035
• https://bugs.debian.org/910766
• https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml
• https://github.com/requests/requests
• https://usn.ubuntu.com/3790-1
• https://usn.ubuntu.com/3790-2
• https://www.oracle.com/security-alerts/cpujul2022.html
• http://docs.python-requests.org/en/master/community/updates/#release-and-version-history
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html

CVE-2018-18074 · published 2018-10-29T19:06:46Z · modified 2024-10-21T21:42:55.896669Z · JSON