CVE-2024-35195

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

CVSS v3 5.6 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
https://github.com/psf/requests/pull/6655
https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-20 21:15

Updated : 2024-06-10 17:16

NVD link : CVE-2024-35195

Mitre link : CVE-2024-35195

CVE.ORG link : CVE-2024-35195

JSON object : View

Products Affected

No product.

CWE

CWE-670

Always-Incorrect Control Flow Implementation

{"id": "CVE-2024-35195", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.3}]}, "published": "2024-05-20T21:15:09.990", "references": [{"url": "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac", "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/requests/pull/6655", "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0."}, {"lang": "es", "value": " Requests es una librer\u00eda HTTP. Antes de 2.32.0, al realizar solicitudes a trav\u00e9s de una `Sesi\u00f3n` de Solicitudes, si la primera solicitud se realiza con `verify=False` para deshabilitar la verificaci\u00f3n de certificados, todas las solicitudes posteriores al mismo host continuar\u00e1n ignorando la verificaci\u00f3n de certificados independientemente de los cambios en el valor de \"verificar\". Este comportamiento continuar\u00e1 durante el ciclo de vida de la conexi\u00f3n en el grupo de conexiones. Esta vulnerabilidad se solucion\u00f3 en 2.32.0."}], "lastModified": "2024-06-10T17:16:29.563", "sourceIdentifier": "security-advisories@github.com"}