psf requests up to 2.31.x Session control flow

Summaryinfo

A vulnerability, which was classified as problematic, has been found in psf requests up to 2.31.x. The affected element is an unknown function of the component Session Handler. This manipulation causes control flow. This vulnerability is registered as CVE-2024-35195. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in psf requests up to 2.31.x and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Session Handler. The manipulation with an unknown input leads to a control flow vulnerability. The CWE definition for the vulnerability is CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-35195 since 05/10/2024. The exploitation appears to be difficult. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 208782 (SUSE SLES12 : Recommended update for python-requests (SUSE-SU-SUSE-RU-2024:3598-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.32.0 eliminates this vulnerability. Applying the patch a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (208782) and CERT Bund (WID-SEC-2025-2363). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Oracle MySQL
• Red Hat Enterprise Linux
• Ubuntu Linux
• Oracle Linux
• RESF Rocky Linux
• Xerox FreeFlow Print Server

Productinfo

Vendor

• psf

Name

• requests

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31

License

• open-source

Website

• Product: https://github.com/psf/requests/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion