Path to dependency file: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt
Path to vulnerable library: /awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt,/awscli-bundle/awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
CVE-2018-18074 - High Severity Vulnerability
Vulnerable Library - requests-2.15.1-py2.py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/fa/a5/e04c4607dc96e3e6b22dfa13ba8776c64bb65cb97ab90f05a3ee14096a0a/requests-2.15.1-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt
Path to vulnerable library: /awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt,/awscli-bundle/awscli-bundle/packages/urllib3-1.25.10.tar/urllib3-1.25.10/docs/requirements.txt
Dependency Hierarchy: - :x: **requests-2.15.1-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: de1c2b0d1a23367b161c2d995029f9693bd8a155
Found in base branch: master
Vulnerability Details
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Publish Date: 2018-10-09
URL: CVE-2018-18074
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-18074
Release Date: 2018-10-09
Fix Resolution: 2.20.0
Step up your Open Source Security Game with Mend here