Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 2 - Core | aws-cfn-bootstrap | 2024-10-10 03:05 | ALAS2-2024-2654 |
Amazon Linux 2023 | aws-cfn-bootstrap | 2024-10-10 03:02 | ALAS2023-2024-732 |
Amazon Linux 2 - Core | python-pip | 2024-12-05 01:02 | ALAS2-2024-2715 |
Amazon Linux 2023 | python-pip | 2024-12-05 20:34 | ALAS2023-2024-781 |
Amazon Linux 2023 | python-requests | 2024-12-05 20:34 | ALAS2023-2024-782 |
Amazon Linux 2023 | python3.11-pip | 2024-12-05 20:34 | ALAS2023-2024-780 |
Amazon Linux 2 - Python3.8 Extra | python38-pip | 2024-12-05 01:00 | ALAS2PYTHON3.8-2024-017 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
NVD | CVSSv3 | 5.6 | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |