requests security issue, CVE-2018-18074

buruzaemon / natto-py

natto-py combines the Python programming language with MeCab, the part-of-speech and morphological analyzer for the Japanese language.

BSD 2-Clause "Simplified" License

92 stars 13 forks source link

requests security issue, CVE-2018-18074 #110

Closed buruzaemon closed 5 years ago

buruzaemon commented 5 years ago

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Upgrade requests to version 2.20.0 or later.

buruzaemon commented 5 years ago

The dependency in question is actually in docs/src/requirements.txt, and doesn't really affect natto-py per se. Nevertheless, we will update the requirements.txt file accordingly.

buruzaemon commented 5 years ago

Fixed.