CVE-2024-35195mediumCWE-670

CVE-2024-35195: falha de média gravidade em psf requests

Requests `Session` object does not verify requests after making first request with verify=False

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar requests+ Monitorar requests

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.6epss 0.3%
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
psf · requests
CVEs relacionadas — psf requests

No mesmo produto, das mais perigosas para as menos.

CVE-2023-32681MEDIUMUnintended leak of Proxy-Authorization header in requestsEPSS 3.0%CVE-2024-47081MEDIUMRequests vulnerable to .netrc credentials leak via malicious URLsEPSS 1.0%CVE-2026-25645MEDIUMRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionEPSS 0.2%