Always-Incorrect Control Flow Implementation Affecting requests package, versions [,2.32.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-REQUESTS-6928867
- published 21 May 2024
- disclosed 20 May 2024
- credit Mike Assel
Introduced: 20 May 2024
CVE-2024-35195 Open this link in a new tabHow to fix?
Upgrade requests to version 2.32.2 or higher.
Overview
Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation when making requests through a Requests Session. An attacker can bypass certificate verification by making the first request with verify=False, causing all subsequent requests to ignore certificate verification regardless of changes to the verify value.
Notes:
For requests <2.32.0, avoid setting
verify=Falsefor the first request to a host while using a Requests Session.For requests <2.32.0, call
close()on Session objects to clear existing connections ifverify=Falseis used.This vulnerability was initially fixed in version 2.32.0, which was yanked. Therefore, the next available fixed version is 2.32.2.