CVE-2018-18074
09.10.2018, 17:29
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| python | requests | 𝑥 < 2.20.0 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 18.10 |
| opensuse | leap | 15.1 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_workstation | 7.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python-pip |
| ||||||||||||||||||||||||||
| requests |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python-requests |
| ||||||||||||||||||||||
| python2-requests |
| ||||||||||||||||||||||
| python3-requests |
| ||||||||||||||||||||||
| python36-requests |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References