p PatchFirst

CVE-2024-47081

CVE-2024-47081 · Requests vulnerable to .netrc credentials leak via malicious URLs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

CVSS 5.3 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • requests

    Versions
    • < 2.32.4: Affected

    No fix published

  • requests Debian:12

    Versions
    • 2.28.1+dfsg-1
    • 2.31.0+dfsg-1
    • 2.31.0+dfsg-2
    • 2.32.3+dfsg-1
    • 2.32.3+dfsg-2
    • 2.32.3+dfsg-3
    • 2.32.3+dfsg-4
    • 2.32.3+dfsg-5
    • 2.32.4+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • requests Debian:13

    Versions
    • 2.32.3+dfsg-5
    Affected ranges
    • ECOSYSTEM: < 2.32.3+dfsg-5+deb13u1

    Update to 2.32.3+dfsg-5+deb13u1

  • requests Debian:14

    Versions
    • 2.32.3+dfsg-5
    Affected ranges
    • ECOSYSTEM: < 2.32.4+dfsg-1

    Update to 2.32.4+dfsg-1

  • requests PyPI

    Versions
    • 0.0.1
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.10.4
    • 0.10.6
    • 0.10.7
    • 0.10.8
    • 0.11.1
    • 0.11.2
    • 0.12.0
    • 0.12.01
    • 0.12.1
    • 0.13.0
    • 0.13.1
    • 0.13.2
    • 0.13.3
    • 0.13.4
    • 0.13.5
    • 0.13.6
    • 0.13.7
    • 0.13.8
    • 0.13.9
    • 0.14.0
    • 0.14.1
    • 0.14.2
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.5.1
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.6
    • 0.8.7
    • 0.8.8
    • 0.8.9
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.10.0
    • 2.11.0
    • 2.11.1
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.12.3
    • 2.12.4
    • 2.12.5
    • 2.13.0
    • 2.14.0
    • 2.14.1
    • 2.14.2
    • 2.15.0
    • 2.15.1
    • 2.16.0
    • 2.16.1
    • 2.16.2
    • 2.16.3
    • 2.16.4
    • 2.16.5
    • 2.17.0
    • 2.17.1
    • 2.17.2
    • 2.17.3
    • 2.18.0
    • 2.18.1
    • 2.18.2
    • 2.18.3
    • 2.18.4
    • 2.19.0
    • 2.19.1
    • 2.2.0
    • 2.2.1
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.22.0
    • 2.23.0
    • 2.24.0
    • 2.25.0
    • 2.25.1
    • 2.26.0
    • 2.27.0
    • 2.27.1
    • 2.28.0
    • 2.28.1
    • 2.28.2
    • 2.29.0
    • 2.3.0
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.32.1
    • 2.32.2
    • 2.32.3
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.7.0
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    • 2.9.2
    Affected ranges
    • ECOSYSTEM: < 2.32.4

    Update to 2.32.4

  • requests Ubuntu:Pro:14.04:LTS

    Versions
    • 1.2.3-1
    • 2.0.0-1
    • 2.2.1-1
    • 2.2.1-1ubuntu0.1
    • 2.2.1-1ubuntu0.2
    • 2.2.1-1ubuntu0.3
    • 2.2.1-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 2.2.1-1ubuntu0.4+esm1

    Update to 2.2.1-1ubuntu0.4+esm1

  • requests Ubuntu:Pro:16.04:LTS

    Versions
    • 2.7.0-3
    • 2.8.1-1
    • 2.9.1-1ubuntu1
    • 2.9.1-2
    • 2.9.1-3
    • 2.9.1-3ubuntu0.1
    • 2.9.1-3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 2.9.1-3ubuntu0.1+esm2

    Update to 2.9.1-3ubuntu0.1+esm2

  • requests Ubuntu:Pro:18.04:LTS

    Versions
    • 2.18.1-1
    • 2.18.4-1
    • 2.18.4-2
    • 2.18.4-2ubuntu0.1
    • 2.18.4-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 2.18.4-2ubuntu0.1+esm2

    Update to 2.18.4-2ubuntu0.1+esm2

  • requests Ubuntu:Pro:20.04:LTS

    Versions
    • 2.21.0-1
    • 2.22.0-2build1
    • 2.22.0-2ubuntu1
    • 2.22.0-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 2.22.0-2ubuntu1.1+esm1

    Update to 2.22.0-2ubuntu1.1+esm1

  • python-pip Ubuntu:22.04:LTS

    Versions
    • 20.3.4-4
    • 21.3.1+dfsg-3
    • 22.0.2+dfsg-1
    • 22.0.2+dfsg-1ubuntu0.1
    • 22.0.2+dfsg-1ubuntu0.2
    • 22.0.2+dfsg-1ubuntu0.3
    • 22.0.2+dfsg-1ubuntu0.4
    • 22.0.2+dfsg-1ubuntu0.5
    • 22.0.2+dfsg-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: < 22.0.2+dfsg-1ubuntu0.7

    Update to 22.0.2+dfsg-1ubuntu0.7

  • requests Ubuntu:22.04:LTS

    Versions
    • 2.25.1+dfsg-2
    • 2.25.1+dfsg-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.25.1+dfsg-2ubuntu0.3

    Update to 2.25.1+dfsg-2ubuntu0.3

  • python-pip Ubuntu:24.04:LTS

    Versions
    • 23.2+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-1ubuntu1
    • 24.0+dfsg-1ubuntu1.1
    • 24.0+dfsg-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 24.0+dfsg-1ubuntu1.3

    Update to 24.0+dfsg-1ubuntu1.3

  • requests Ubuntu:24.04:LTS

    Versions
    • 2.31.0+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.31.0+dfsg-1ubuntu1.1

    Update to 2.31.0+dfsg-1ubuntu1.1

  • requests Ubuntu:25.10

    Versions
    • 2.32.3+dfsg-4ubuntu1
    • 2.32.3+dfsg-5ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.32.3+dfsg-5ubuntu2

    Update to 2.32.3+dfsg-5ubuntu2

Original sources

Check your server →