Insufficiently protected credentials in Requests - CVE-2024-47081

Vulnerability identifier: #VU111716

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-47081

CWE-ID: CWE-522

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the library leaks .netrc credentials to third parties for specific maliciously-crafted URLs. A remote attacker can gain access to sensitive information. 

Requests
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Fedora
Netezza Appliance
QRadar Investigation Assistant
watsonx Orchestrate Developer Edition
Truststore Manager
Storage Defender - Resiliency Service
Guardium Data Security Center (GDSC)
Data Product Hub
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Location Service for Esri Component
Maximo Application Suite - Predict Component
Maximo Application Suite Ai Service
Astronomer with IBM
QRadar App SDK
SOAR QRadar Plugin App
Db2 Big SQL
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite
IBM Business Automation Workflow
Red Hat Advanced Cluster Management for Kubernetes
IBM Maximo Application Suite - Manage Component
IBM Cloud Pak for Data System
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
requests (Ubuntu package)
python-requests (Red Hat package)
python3-requests
python-requests
python2-requests
python-requests-help
python3-requests+socks
python3-requests+security
python-requests-doc
mingw-python-requests
resource-agents (Red Hat package)
ldirectord
resource-agents-debuginfo
resource-agents-debugsource
resource-agents-help
resource-agents
fence-agents (Red Hat package)
resource-agents-gcp
resource-agents-paf
resource-agents-aliyun
pypy
python-pip-wheel
python2-pip
python-pip-help
python3-pip
python-pip
python-pip (Ubuntu package)
Splunk Enterprise
Splunk Security Orchestration, Automation and Response (SOAR)
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Virtualization
Red Hat Ceph Storage
AMQ Broker
Juniper Junos Space

Install updates from vendor's website.

Requests - update to 2.32.4
Netezza Appliance - update to 1.0.0.1
QRadar Investigation Assistant - update to 1.1.0
Netcool Operations Insight - update to 1.6.15
watsonx Orchestrate Developer Edition - update to 1.13.0
Truststore Manager - update to 1.7.1
Storage Defender - Resiliency Service - update to 2.0.16
IBM Fusion HCI - update to 2.11.0
Guardium Data Security Center (GDSC) - addressed in versions 3.8.1, 3.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.2
Data Product Hub - update to 5.2.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.21, 9.0.13, 9.1.3
Splunk Enterprise - addressed in versions 9.3.10, 9.4.9, 10.0.4, 10.2.1
Maximo Application Suite - Predict Component - update to 9.1.1
Maximo Application Suite Ai Service - update to 9.1.1
IBM Business Automation Workflow - update to 24.0.0-IF006
Red Hat OpenShift Serverless - update to 1
Astronomer with IBM - update to 1.1.0
requests (Ubuntu package) - addressed in versions 2.2.1-1ubuntu0.4+esm1, 2.9.1-3ubuntu0.1+esm2, 2.18.4-2ubuntu0.1+esm2, 2.22.0-2ubuntu1.1+esm1, 2.25.1+dfsg-2ubuntu0.3, 2.31.0+dfsg-1ubuntu1.1, 2.32.3+dfsg-1ubuntu1.1, 2.32.3+dfsg-4ubuntu1.1
QRadar App SDK - update to 2.2.4
Multicluster Engine for Kubernetes - addressed in versions 2.7.6, 2.8.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.12.5, 2.13.4
python-requests (Red Hat package) - addressed in versions 2.20.0-3.el8_2, 2.20.0-3.el8_4, 2.20.0-3.el8_6.1, 2.20.0-3.el8_8.1, 2.20.0-6.el8_10, 2.25.1-10.el9_6, 2.32.4-1.el10_0
python3-requests - addressed in versions 2.20.0-6, 2.32.3-2
python3-requests - addressed in versions 2.24.0-8.20.1, 2.24.0-8.23.1, 2.25.1-150300.3.15.1
python-requests - update to 2.24.0-8.23.1
python2-requests - update to 2.25.1-150300.3.15.1
python-requests - addressed in versions 2.26.0-10, 2.31.0-3
python-requests-help - addressed in versions 2.26.0-10, 2.31.0-3
python3-requests - addressed in versions 2.26.0-10, 2.31.0-3
python3-requests+socks - update to 2.32.3-2
python3-requests+security - update to 2.32.3-2
python-requests-doc - update to 2.32.3-2
python-requests - addressed in versions 2.32.4-1.fc41, 2.32.4-1.fc42
mingw-python-requests - addressed in versions 2.32.4-1.fc41, 2.32.4-1.fc42
resource-agents (Red Hat package) - addressed in versions 4.1.1-90.el8_4.20, 4.9.0-16.el8_6.17, 4.9.0-40.el8_8.11, 4.9.0-54.el8_10.16
ldirectord - addressed in versions 4.2.0-4, 4.2.0-5, 4.13.0-26, 4.15.1-2
resource-agents-debuginfo - addressed in versions 4.2.0-4, 4.2.0-5, 4.13.0-26, 4.15.1-2
resource-agents-debugsource - addressed in versions 4.2.0-4, 4.2.0-5, 4.13.0-26, 4.15.1-2
resource-agents-help - addressed in versions 4.2.0-4, 4.2.0-5, 4.13.0-26, 4.15.1-2
resource-agents - addressed in versions 4.2.0-4, 4.2.0-5, 4.13.0-26, 4.15.1-2
fence-agents (Red Hat package) - addressed in versions 4.2.1-65.el8_4.21, 4.2.1-89.el8_6.15, 4.2.1-112.el8_8.11, 4.2.1-129.el8_10.14
resource-agents-gcp - update to 4.9.0-54
resource-agents-paf - update to 4.9.0-54
resource-agents-aliyun - update to 4.9.0-54
resource-agents - update to 4.9.0-54
OpenShift Virtualization - update to 4.12.20
SOAR QRadar Plugin App - update to 5.6.2
Red Hat Ceph Storage - update to 7.1
Splunk Security Orchestration, Automation and Response (SOAR) - update to 7.1.0
pypy - addressed in versions 7.3.20-2.fc41, 7.3.20-2.fc42, 7.3.20-2.fc43
AMQ Broker - update to 7.13.2
Db2 Big SQL - update to 8.2
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.29, 8.7.23, 9.0.16
IBM Cloud Pak for Data System - update to 8.10.26.01.SP11
python-pip-wheel - addressed in versions 20.2.2-10, 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-9, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-4, 23.3.1-7, 23.3.1-9
python2-pip - addressed in versions 20.2.2-10, 20.2.2-12, 20.2.2-14, 20.2.2-15
python-pip-help - addressed in versions 20.2.2-10, 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-9, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-4, 23.3.1-7, 23.3.1-9
python3-pip - addressed in versions 20.2.2-10, 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-9, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-4, 23.3.1-7, 23.3.1-9
python-pip - addressed in versions 20.2.2-10, 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-9, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-4, 23.3.1-7, 23.3.1-9
python-pip (Ubuntu package) - addressed in versions 22.0.2+dfsg-1ubuntu0.7, 24.0+dfsg-1ubuntu1.3, 25.0+dfsg-1ubuntu0.2
python3-pip - update to 23.3.1-4
python-pip-wheel - update to 23.3.1-4
Juniper Junos Space - update to 26.1R1 Patch V1

• http://seclists.org/fulldisclosure/2025/Jun/2
• http://www.openwall.com/lists/oss-security/2025/06/03/11
• http://www.openwall.com/lists/oss-security/2025/06/03/9
• http://www.openwall.com/lists/oss-security/2025/06/04/1
• http://www.openwall.com/lists/oss-security/2025/06/04/6
• https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
• https://github.com/psf/requests/pull/6965
• https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
• https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env
• https://seclists.org/fulldisclosure/2025/Jun/2

• Information disclosure in Python Requests library
• SUSE update for python3-requests
• SUSE update for python-requests
• SUSE update for python-requests
• Ubuntu update for requests
• openEuler update for python-requests
• openEuler 20.03 LTS SP4 update for resource-agents
• openEuler 24.03 LTS update for resource-agents
• openEuler 22.03 LTS SP4 update for resource-agents
• Fedora 42 update for mingw-python-requests
• Fedora 41 update for mingw-python-requests
• Fedora 42 update for python-requests
• Fedora 41 update for python-requests
• Fedora 43 update for pypy
• Fedora 42 update for pypy
• Fedora 41 update for pypy
• openEuler 24.03 LTS SP2 update for resource-agents
• openEuler 24.03 LTS SP1 update for resource-agents
• openEuler 22.03 LTS SP3 update for resource-agents
• openEuler 24.03 LTS SP2 update for python-requests
• Anolis OS update for python-requests
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Red Hat Enterprise Linux 9 update for python-requests
• Red Hat Enterprise Linux 8 update for python-requests
• Multiple vulnerabilities in IBM Business Automation Workflow
• Anolis OS update for python-requests
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Red Hat Enterprise Linux 10 update for python-requests
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Red Hat Enterprise Linux 8 update for fence-agents
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
• Red Hat Enterprise Linux 8 update for resource-agents
• Red Hat Enterprise Linux 8 update for python-requests
• Red Hat Enterprise Linux 8 update for python-requests
• Anolis OS update for resource-agents
• openEuler 24.03 LTS SP2 update for python-pip
• openEuler 24.03 LTS SP1 update for python-pip
• openEuler 22.03 LTS SP3 update for python-pip
• Multiple vulnerabilities in IBM QRadar App SDK
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 8 update for resource-agents
• Red Hat Enterprise Linux 8 update for resource-agents
• Red Hat Enterprise Linux 8 update for resource-agents
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 8 update for python-requests
• openEuler 24.03 LTS update for python-pip
• Red Hat Enterprise Linux 8 update for python-requests
• Multiple vulnerabilities in IBM Fusion
• Ubuntu update for python-pip
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• IBM Maximo AI Service update for Requests
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 22.03 LTS SP3 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.8
• IBM Watson Discovery update for Requests
• IBM Maximo Application Suite - Predict Component update for Requests
• Multiple vulnerabilities in IBM Truststore Manager
• Multiple vulnerabilities in AMQ Broker 7.13
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• IBM watsonx Orchestrate Developer Edition update for Requests
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Edge Data Collector update for Requests
• IBM Watson Speech Services Cartridge update for Requests
• Anolis OS update for python-pip
• IBM Maximo Application Suite - Manage Component update for Requests
• Astronomer with IBM update for requests package
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM Netezza Appliance update for Requests
• IBM Maximo Application Suite - Monitor Component update for Requests
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• IBM Db2 Big SQL on Cloud Pak for Data update for Requests
• openEuler 24.03 LTS SP1 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Splunk SOAR update for third-party components
• openEuler 24.03 LTS update for python-pip
• openEuler 24.03 LTS SP2 update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• openEuler 24.03 LTS SP1 update for python-pip
• openEuler 24.03 LTS update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 24.03 LTS SP3 update for python-pip
• openEuler 24.03 LTS SP2 update for python-pip
• Multiple vulnerabilities in Splunk Enterprise
• IBM Cloud Pak for Data System 2.0 update for Requests
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem
• Multiple vulnerabilities in Junos Space