RHSA-2019:2035: Low: python-requests security update
The python-requests package contains a library designed to make HTTP requests easy for developers.<br>Security Fix(es):<br><li> python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Additional Changes:<br>For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2019:2035?
The severity of RHSA-2019:2035 is classified as moderate.
How do I fix RHSA-2019:2035?
To fix RHSA-2019:2035, update the python-requests package to version 2.6.0-5.el7.
What vulnerability does RHSA-2019:2035 address?
RHSA-2019:2035 addresses the vulnerability where the Authorization header is not removed when redirecting from HTTPS to HTTP.
Which software is affected by RHSA-2019:2035?
The affected software for RHSA-2019:2035 is the python-requests package prior to version 2.6.0-5.el7.
What is CVE-2018-18074 related to RHSA-2019:2035?
CVE-2018-18074 is the identifier for the specific vulnerability fixed in RHSA-2019:2035 regarding the handling of the Authorization header during HTTP redirection.