Read the docs
TI-2018-12846 Aliases CVE-2018-18074GHSA-x84v-xcm2-53pg

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an…

Priority MEDIUM 43CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 10 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.

Summary

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Why it matters now

EPSS 0.06925 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial requests (PyPI): 2.20.0Red Hat: 7 advisoriesRed Hat: 10 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—requests (PyPI)before 2.20.02.20.0Patch availableGHSA-x84v-xcm2-53pg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • requests (PyPI) Vendor— Affected before 2.20.0 Fixed in 2.20.0 Patch available GHSA-x84v-xcm2-53pg

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:python:requests:*:*:*:*:*:*:*:*before 2.20.0Vulnerablepython-pillow
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:python:requests:*:*:*:*:*:*:*:* Versions before 2.20.0 Vulnerable ·python-pillow
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-x84v-xcm2-53pg requests (PyPI) Fixed in 2.20.0 Advisory →

Red Hat 7 advisories

  • RHSA-2020:2068 Released 2020-05-12 · Red Hat rating Moderate
    python-pip security update
    • Red Hat Enterprise Linux Client (v. 7) python-pip-9.0.3-7.el7_8, python3-pip-9.0.3-7.el7_8
    • Red Hat Enterprise Linux ComputeNode (v. 7) python-pip-9.0.3-7.el7_8, python3-pip-9.0.3-7.el7_8
    • Red Hat Enterprise Linux Server (v. 7) python-pip-9.0.3-7.el7_8, python3-pip-9.0.3-7.el7_8
    • Red Hat Enterprise Linux Workstation (v. 7) python-pip-9.0.3-7.el7_8, python3-pip-9.0.3-7.el7_8
  • RHSA-2020:2081 Released 2020-05-12 · Red Hat rating Moderate
    python-virtualenv security update
    • Red Hat Enterprise Linux Client Optional (v. 7) python-virtualenv-15.1.0-4.el7_8
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-virtualenv-15.1.0-4.el7_8
    • Red Hat Enterprise Linux Server (v. 7) python-virtualenv-15.1.0-4.el7_8
    • Red Hat Enterprise Linux Workstation (v. 7) python-virtualenv-15.1.0-4.el7_8
  • RHSA-2020:1605 Released 2020-04-28 · Red Hat rating Moderate
    python27:2.7 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-9.module+el8.1.0+3111+de3f2d8e.noarch::python27:2.7 +47
Show 4 more Red Hat advisories
  • RHSA-2020:1916 Released 2020-04-28 · Red Hat rating Moderate
    python-pip security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3-pip-9.0.3-16.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-pip-9.0.3-16.el8, python-pip-9.0.3-16.el8, python3-pip-wheel-9.0.3-16.el8
  • RHSA-2020:0851 Released 2020-03-17 · Red Hat rating Moderate
    python-virtualenv security update
    • Red Hat Enterprise Linux Client Optional (v. 7) python-virtualenv-15.1.0-4.el7_7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-virtualenv-15.1.0-4.el7_7
    • Red Hat Enterprise Linux Server (v. 7) python-virtualenv-15.1.0-4.el7_7
    • Red Hat Enterprise Linux Workstation (v. 7) python-virtualenv-15.1.0-4.el7_7
  • RHSA-2020:0850 Released 2020-03-17 · Red Hat rating Moderate
    python-pip security update
    • Red Hat Enterprise Linux Client (v. 7) python-pip-9.0.3-7.el7_7, python3-pip-9.0.3-7.el7_7
    • Red Hat Enterprise Linux ComputeNode (v. 7) python-pip-9.0.3-7.el7_7, python3-pip-9.0.3-7.el7_7
    • Red Hat Enterprise Linux Server (v. 7) python-pip-9.0.3-7.el7_7, python3-pip-9.0.3-7.el7_7
    • Red Hat Enterprise Linux Workstation (v. 7) python-pip-9.0.3-7.el7_7, python3-pip-9.0.3-7.el7_7
  • RHSA-2019:2035 Released 2019-08-06 · Red Hat rating Low
    python-requests security update
    • Red Hat Enterprise Linux Client (v. 7) python-requests-2.6.0-5.el7
    • Red Hat Enterprise Linux ComputeNode (v. 7) python-requests-2.6.0-5.el7
    • Red Hat Enterprise Linux Server (v. 7) python-requests-2.6.0-5.el7
    • Red Hat Enterprise Linux Workstation (v. 7) python-requests-2.6.0-5.el7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 12 (Pike)AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix yet: Fix deferred
Red Hat Ansible Tower 3.5 for RHEL 7 ServerFixed—
Red Hat Ansible Tower 3.6 for RHEL 7Fixed—
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:1605, RHSA-2020:1916
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:1916
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2019:2035, RHSA-2020:0850, RHSA-2020:2068
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:0851, RHSA-2020:2081
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2019:2035, RHSA-2020:0850, RHSA-2020:2068
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:0851, RHSA-2020:2081
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2035, RHSA-2020:0850, RHSA-2020:0851, RHSA-2020:2068, RHSA-2020:2081
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2035, RHSA-2020:0850, RHSA-2020:0851, RHSA-2020:2068, RHSA-2020:2081
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-18074
  2. 2026-10-03 Alias added: GHSA-x84v-xcm2-53pg

References

Exploit 2

Patch 2

Advisory 6

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences