Vulnerable versions:<= 2.19.1Patched version:2.20.0
The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Vulnerability alert:
requestsCVE-2018-18074
Vulnerable versions:
<= 2.19.1Patched version:2.20.0The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.Remediation
Upgrade
requeststo version2.20.0or later.