Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Requests library may expose saved credentials to attackers
published 1 year ago
Summary
The popular Python Requests tool, in versions before 2.32.4, can unintentionally send passwords stored in a .netrc file to a malicious website when that site uses a specially crafted link. This could let outsiders see credentials meant only for internal use. Update Requests to version 2.32.4, or disable the use of the .netrc file by setting trust_env=False in your code, to stop the leak.
What to do
- Update redhat python-requests to version 0:2.20.0-3.el8_2.
- Update redhat python3-requests to version 0:2.20.0-3.el8_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_aus:8.2::baseos | redhat | python-requests |
< 0:2.20.0-3.el8_2 Fix: upgrade to 0:2.20.0-3.el8_2
|
| Red Hat:rhel_aus:8.2::baseos | redhat | python3-requests |
< 0:2.20.0-3.el8_2 Fix: upgrade to 0:2.20.0-3.el8_2
|
Original advisory text
Red Hat Security Advisory: python-requests security update
References
- https://access.redhat.com/errata/RHSA-2025:15723 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2371272 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15723.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-47081 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-47081 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47081 Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Jun/2 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/06/03/11 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/06/03/9 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/06/04/1 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/06/04/6 Third Party Advisory
- https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef Third Party Advisory
- https://github.com/psf/requests/pull/6965 Third Party Advisory
- https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7 Third Party Advisory
- https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env Third Party Advisory
- https://seclists.org/fulldisclosure/2025/Jun/2 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Sep 2025
Updated6 May 2026
First seen6 May 2026
Sources
RHSA-2025:15723 · OSV
Track software like this
Free during beta