NA

CVE-2024-35195

Published: 20/05/2024 Updated: 21/05/2024

Vulnerability Summary

Requests is a HTTP library. before 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

Vendor Advisories

Debian Bug report logs - #1071593 requests: CVE-2024-35195 Package: src:requests; Maintainer for src:requests is Debian Python Team <team+python@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 21 May 2024 20:03:01 UTC Severity: important Tags: security, upstream Found in version ...