Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
Requests library can keep SSL verification disabled
published 1 year ago
Summary
If your application uses the Requests library and disables certificate checking for one request, later requests to the same site may continue without verification, even if you turn verification back on. This can allow attackers to intercept or alter data. Upgrade to version 2.32.0 or newer to fix the issue.
What to do
- Update redhat python-requests to version 0:2.20.0-5.el8_10.
- Update redhat python3-requests to version 0:2.20.0-5.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::baseos | redhat | python-requests |
< 0:2.20.0-5.el8_10 Fix: upgrade to 0:2.20.0-5.el8_10
|
| Red Hat:enterprise_linux:8::baseos | redhat | python3-requests |
< 0:2.20.0-5.el8_10 Fix: upgrade to 0:2.20.0-5.el8_10
|
Original advisory text
Red Hat Security Advisory: python-requests security update
References
- https://access.redhat.com/errata/RHSA-2025:0012 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2282114 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0012.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-35195 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-35195 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-35195 Vendor Advisory
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published3 Jan 2025
Updated6 May 2026
First seen6 May 2026
Sources
RHSA-2025:0012 · OSV
Track software like this
Free during beta