CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False
First published: Mon May 20 2024(Updated: )
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/requests | <2.32.0 | 2.32.0 |
| redhat/requests | <2.32.0 | 2.32.0 |
| F5 Traffix SDC | =5.1.0 | 5.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
- https://github.com/psf/requests/pull/6655
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/
- https://nvd.nist.gov/vuln/detail/CVE-2024-35195
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ
- https://github.com/advisories/GHSA-9wx4-h78v-vm56 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282126
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282115
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282127
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282128
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282129
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282130
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282116
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282131
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282132
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282133
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282134
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282135
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282136
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282137
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282138
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282117
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282118
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282139
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282140
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282141
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282119
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282142
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282143
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282144
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282145
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282146
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282147
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282120
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282148
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282149
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282150
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282151
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282121
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282152
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282153
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282122
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282154
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282155
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282123
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282156
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282157
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282124
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282158
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282159
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282160
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282161
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282162
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282125
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282189
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2282205
- https://access.redhat.com/errata/RHSA-2024:3781
- https://access.redhat.com/errata/RHSA-2024:4522
- https://bugzilla.redhat.com/show_bug.cgi?id=2282114
- https://my.f5.com/manage/s/article/K000141129
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/event
- agent/author
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9wx4-h78v-vm56
- alias/CVE-2024-35195
- agent/software-canonical-lookup
- agent/severity
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/f5-advisory
- source/F5
- package-manager/pip
- package-manager/redhat
- vendor/f5
- canonical/f5 traffix sdc
- version/f5 traffix sdc/5.1.0