[Cycode] Fix for vulnerable manifest file dependency - requests updated to version 2.20.0#140
Conversation
…ed to version 2.20.0
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
| -r ../dev-requirements.txt | ||
| sphinx>3.0.0 | ||
| requests>=2,<2.16 | ||
| requests==2.20.0 |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function: CVE-2026-25645 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.20.0 |
| Direct Dependency | Yes |
| Upgrade | 2.33.0 |
Impact
The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
Affected usages
Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.
Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
| -r ../dev-requirements.txt | ||
| sphinx>3.0.0 | ||
| requests>=2,<2.16 | ||
| requests==2.20.0 |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Requests Session object does not verify requests after making first request with verify=False: CVE-2024-35195 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.20.0 |
| Direct Dependency | Yes |
| Upgrade | 2.32.0 |
When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later.
This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.
This behavior affects versions of requests prior to 2.32.0.
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
![cycode-security-eu[bot]](https://avatars.githubusercontent.com/in/242055?s=60&v=4){kind=small}
| -r ../dev-requirements.txt | ||
| sphinx>3.0.0 | ||
| requests>=2,<2.16 | ||
| requests==2.20.0 |
There was a problem hiding this comment.
❗Cycode: Security vulnerabilities found in newly introduced dependency.
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.20.0 |
| Direct Dependency | Yes |
The following vulnerabilities were introduced:
| GHSA | CVE | Severity | Fixed Version |
|---|---|---|---|
| GHSA-gc5v-m9x4-r6x2 | CVE-2026-25645 | MEDIUM | 2.33.0 |
| GHSA-9hjg-9r4m-mvj7 | CVE-2024-47081 | MEDIUM | 2.32.4 |
| GHSA-9wx4-h78v-vm56 | CVE-2024-35195 | MEDIUM | 2.32.0 |
| GHSA-j8r2-6x86-q33q | CVE-2023-32681 | MEDIUM | 2.31.0 |
Highest fixed version: 2.33.0
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
| -r ../dev-requirements.txt | ||
| sphinx>3.0.0 | ||
| requests>=2,<2.16 | ||
| requests==2.20.0 |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Unintended leak of Proxy-Authorization header in requests: CVE-2023-32681 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.20.0 |
| Direct Dependency | Yes |
| Upgrade | 2.31.0 |
Impact
Since Requests v2.3.0, Requests has been vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected. Note this behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080).
Current vulnerable behavior(s):
- HTTP → HTTPS: leak
- HTTPS → HTTP: no leak
- HTTPS → HTTPS: leak
- HTTP → HTTP: no leak
For HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.
The reason this currently works for HTTPS connections in Requests is the Proxy-Authorization header is also handled by urllib3 with our usage of the ProxyManager in adapters.py with proxy_manager_for. This will compute the required proxy headers in proxy_headers and pass them to the Proxy Manager, avoiding attaching them directly to the Request object. This will be our preferred option going forward for default usage.
Patches
Starting in Requests v2.31.0, Requests will no longer attach this header to redirects with an HTTPS destination. This should have no negative impacts on the default behavior of the library as the proxy credentials are already properly being handled by urllib3's ProxyManager.
For users with custom adapters, this may be potentially breaking if you were already working around this behavior. The previous functionality of rebuild_proxies doesn't make sense in any case, so we would encourage any users impacted to migrate any handling of Proxy-Authorization directly into their custom adapter.
Workarounds
For users who are not able to update Requests immediately, there is one potential workaround.
You may disable redirects by setting allow_redirects to False on all calls through Requests top-level APIs. Note that if you're currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination.
import requests
r = requests.get('http://github.com/', allow_redirects=False)
Credits
This vulnerability was discovered and disclosed by the following individuals.
Dennis Brinkrolf, Haxolot (https://haxolot.com/)
Tobias Funke, (tobiasfunke93@gmail.com)
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
| -r ../dev-requirements.txt | ||
| sphinx>3.0.0 | ||
| requests>=2,<2.16 | ||
| requests==2.20.0 |
There was a problem hiding this comment.
❗Cycode: Security vulnerability found in newly introduced dependency.
| Severity | Medium |
| Issue | Requests vulnerable to .netrc credentials leak via malicious URLs: CVE-2024-47081 |
| Ecosystem | PyPI |
| Dependency | requests |
| Dependency Paths | requests 2.20.0 |
| Direct Dependency | Yes |
| Upgrade | 2.32.4 |
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
References
psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2
Description
Detects when new vulnerabilities affect your dependencies.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_ignore_manifest_here <reason> | Applies to this manifest in this request only |
| #cycode_ignore_package_everywhere <reason> | Applies to this manifest for this package for all requests in your repository |
| #cycode_ignore_package_here <reason> | Applies to this manifest for this package in this request only |
| #cycode_vulnerable_package_fix_this_violation | Fix this violation via a commit to this branch |
Cycode Vulnerable Dependencies Update
This pull request updates the following manifest file:
gitea/repositories/white-rabbit/docs/requirements.txt📂 gitea/repositories/white-rabbit/docs/requirements.txt
1 package will be updated to resolve vulnerabilities:
requests