CVE-2018-18074
Quick assessment
Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Requests package for Python是一款基于Python的开源HTTP库。 Requests package for Python 2.19.1及之前版本（2018-09-14之前发布）中存在安全漏洞，该漏洞源于程序在接收到从https转换到http的重定向请求（带有相同主机名）时，会将HTTP Authorization包头发送到http URI。远程攻击者可通过嗅探网络利用该漏洞获取凭证。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-18074
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Python 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Requests package for Python是一款基于Python的开源HTTP库。 Requests package for Python 2.19.1及之前版本（2018-09-14之前发布）中存在安全漏洞，该漏洞源于程序在接收到从https转换到http的重定向请求（带有相同主机名）时，会将HTTP Authorization包头发送到http URI。远程攻击者可通过嗅探网络利用该漏洞获取凭证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2018-18074
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-18074
请登录查看更多情报信息。
Patches & Fixes for CVE-2018-18074 (2)
-
https://github.com/requests/requests/pull/4718 x_refsource_MISC
Vendor Advisories for CVE-2018-18074 (4)
-
https://bugs.debian.org/910766 x_refsource_MISC
-
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
-
-
Mailing List Discussions for CVE-2018-18074 (1)
-
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html vendor-advisory x_refsource_SUSE
Other References for CVE-2018-18074 (2)
-
https://github.com/requests/requests/issues/4716 x_refsource_MISC
Same Patch Batch · n/a · 2018-10-09 · 39 CVEs total
| CVE-2018-18084 | DuomiCMS SQL注入漏洞 | |
| CVE-2018-18191 | Dayrui FineCms 跨站请求伪造漏洞 | |
| CVE-2018-18192 | libgig 代码问题漏洞 | |
| CVE-2018-18193 | libgig 安全漏洞 | |
| CVE-2018-18194 | libgig 缓冲区错误漏洞 | |
| CVE-2018-18195 | libgig 安全漏洞 | |
| CVE-2018-18196 | libgig 缓冲区错误漏洞 | |
| CVE-2018-18197 | libgig 安全漏洞 | |
| CVE-2018-18082 | Waimai Super Cms 跨站脚本漏洞 | |
| CVE-2018-18083 | DuomiCMS 安全漏洞 | |
| CVE-2018-18190 | GoPro gpmf-parser 安全漏洞 | |
| CVE-2018-18075 | WikidForum SQL注入漏洞 | |
| CVE-2018-14081 | D-Link DIR-809 A1、A2和Guest Zone 安全漏洞 | |
| CVE-2018-14080 | D-Link DIR-809 A1、A2和Guest Zone 安全漏洞 | |
| CVE-2018-15542 | org.telegram.messenger application for Android 安全漏洞 | |
| CVE-2018-15543 | org.telegram.messenger application for Android 安全漏洞 | |
| CVE-2018-18029 | Navigate CMS 跨站脚本漏洞 | |
| CVE-2018-18070 | Daimler Mercedes-Benz COMAND 安全漏洞 | |
| CVE-2018-18071 | Daimler Mercedes-Benz Me app for iOS 安全漏洞 | |
| CVE-2018-7633 | ADB Epicentro 代码注入漏洞 |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2018-18074
No comments yet