You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Vulnerable Library - requests-2.31.0-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/astroscaler
Path to vulnerable library: /tmp/ws-scm/astroscaler,/test-requirements.txt,/requirements.txt
Found in HEAD commit: d59358adee6f9667bcccdb1f41fe4c5cfcd36766
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-35195
Vulnerable Library - requests-2.31.0-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/astroscaler
Path to vulnerable library: /tmp/ws-scm/astroscaler,/test-requirements.txt,/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d59358adee6f9667bcccdb1f41fe4c5cfcd36766
Found in base branch: main
Vulnerability Details
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests
Session
, if the first request is made withverify=False
to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value ofverify
. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.Publish Date: 2024-05-20
URL: CVE-2024-35195
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9wx4-h78v-vm56
Release Date: 2024-05-20
Fix Resolution: requests - 2.32.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: