CVE-2018-18074: High severity Python Requests vulnerability
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
Other sources
Python Requests before version 2.20.0 does not remove the HTTP Authorization header when following a HTTPS to HTTP redirect, allowing for the potential transmission of user credentials in plaintext.
Upstream Patch:
https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff
Upstream Issue:
https://github.com/requests/requests/pull/4718
— Red Hat
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-18074.
What is the severity of CVE-2018-18074?
The severity of CVE-2018-18074 is high with a CVSS score of 7.5.
How does CVE-2018-18074 affect python-requests?
CVE-2018-18074 affects python-requests version up to and excluding 2.20.0.
How can I fix CVE-2018-18074 in python-requests?
To fix CVE-2018-18074 in python-requests, upgrade to version 2.20.0 or higher.
Where can I find more information about CVE-2018-18074?
More information about CVE-2018-18074 can be found in the references section of the vulnerability report.