Vulnerability · Published May 20, 2024 · Assigned by GitHub_M
CVE-2024-35195Requests `Session` object does not verify requests after making first request with verify=False
Medium 5.6
In plain English
A medium-severity security flaw in requests from psf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python3-requests | 2.20.0-5.el8_10 | ALSA-2025:0012 |
| AlmaLinux:9 | python3-requests | 2.25.1-9.el9 | ALSA-2025:7049 |
| AlmaLinux:9 | python3-requests+security | 2.25.1-9.el9 | ALSA-2025:7049 |
| AlmaLinux:9 | python3-requests+socks | 2.25.1-9.el9 | ALSA-2025:7049 |
| Alpine:v3.20 | py3-requests | 2.32.3-r0 | ALPINE-CVE-2024-35195 |
| Alpine:v3.21 | py3-requests | 2.32.3-r0 | ALPINE-CVE-2024-35195 |
| Alpine:v3.22 | py3-requests | 2.32.3-r0 | ALPINE-CVE-2024-35195 |
| Alpine:v3.23 | py3-requests | 2.32.3-r0 | ALPINE-CVE-2024-35195 |
| Alpine:v3.24 | py3-requests | 2.32.3-r0 | ALPINE-CVE-2024-35195 |
| Debian:12 | requests | no fix listed | DEBIAN-CVE-2024-35195 |
| Debian:13 | requests | 2.32.3+dfsg-1 | DEBIAN-CVE-2024-35195 |
| Debian:14 | requests | 2.32.3+dfsg-1 | DEBIAN-CVE-2024-35195 |
| PyPI | requests | 2.32.0 | GHSA-9wx4-h78v-vm56 |
| PyPI | requests | 2.32.0 | PYSEC-2026-1873 |
| Rocky Linux:8 | python-requests | 0:2.20.0-5.el8_10 | RLSA-2025:0012 |
| Rocky Linux:9 | python-requests | 0:2.25.1-9.el9 | RLSA-2025:7049 |
| Ubuntu:26.10 | python-pip | no fix listed | UBUNTU-CVE-2024-35195 |
| Ubuntu:22.04:LTS | requests | no fix listed | UBUNTU-CVE-2024-35195 |
| Ubuntu:24.04:LTS | requests | no fix listed | UBUNTU-CVE-2024-35195 |
Affected products (as reported)
Weakness: CWE-670 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56 x_refsource_CONFIRM
- https://github.com/psf/requests/pull/6655 x_refsource_MISC
- https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/