CVE-2024-35195

MEDIUM5.6EPSS 0.04%

Requests `Session` object does not verify requests after making first request with verify=False

發布日:2024/5/20修改日:2026/2/4
也稱為:GHSA-9wx4-h78v-vm56ALPINE-CVE-2024-35195CGA-h732-75mv-vfrpDEBIAN-CVE-2024-35195

描述

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later. This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity. This behavior affects versions of `requests` prior to 2.32.0.

受影響套件(3)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.6CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

參考連結(9)