Security features bypass in Requests - CVE-2024-35195

Vulnerability identifier: #VU90156

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-35195

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
Requests
Oracle Solaris
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Availability Extension 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Manager Client Tools for SLE
Public Cloud Module
Advanced Systems Management Module
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Python 3 Module
openSUSE Leap
openEuler
Ubuntu
Fedora
IBM Cloud Pak for Data System
IBM Concert Software
Cryostat
IBM Watson Knowledge Catalog in Cloud Pak for Data
Red Hat Satellite
IBM Spectrum Protect Plus
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core DBTier
IBM Observability with Instana
Multicluster GlobalHub
IBM Process Mining
Ansible Automation Platform
Qradar Advisor
IBM Fusion HCI
Red Hat Advanced Cluster Management for Kubernetes
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Decision Optimization for Cloud Pak for Data
Red Hat Update Infrastructure (RHUI)
App Connect Enterprise Certified Container
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
IBM Sterling Connect:Direct Web Services
IBM Maximo Application Suite
Red Hat OpenStack
IBM Robotic Process Automation
IBM Business Automation Workflow
Netezza Appliance
Oracle Utilities Network Management System
Guardium Data Security Center (GDSC)
IBM Cloud Pak for Watson AIOps
Oracle Communications Operations Monitor
WatsonX BI Assistant
Oracle Business Intelligence Enterprise Edition
Maximo Application Suite - Predict Component
Oracle Communications Policy Management
Business Automation Insights
APEX Cloud Platform for Microsoft Azure
QRadar App SDK
Data Observability by Databand Self-Hosted
QRadar Deployment Intelligence App
Security QRadar EDR
Storage Resource Manager
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
SOAR QRadar Plugin App
Db2 Big SQL
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Storage Protect Plus File Systems Agent
IBM Netezza for Cloud Pak for Data
Robotic Process Automation for Cloud Pak
Voice Gateway
Communications Unified Assurance
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Nautobot
Oracle Financial Services Compliance Studio
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Oracle Banking Liquidity Management
QRadar Suite
Splunk Enterprise
Juniper Secure Analytics (JSA)
Python for Scientific Computing
Traffix SDC
QRadar Manager for YARA and SIGMA Rules App
Red Hat OpenShift Container Platform
MySQL Cluster
PeopleSoft Enterprise PeopleTools
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository
libcomps (Red Hat package)
aap-metrics-utility (Red Hat package)
crosswords
crosswords-puzzle-sets-xword-dl
python-json-stream-rs-tokenizer (Red Hat package)
python-iniparse (Red Hat package)
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-drf-spectacular (Red Hat package)
python-pulp-cli (Red Hat package)
python-pulp-glue (Red Hat package)
m2crypto (Red Hat package)
python-drf-nested-routers (Red Hat package)
scap-security-guide-satellite (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
python-asyncio-throttle (Red Hat package)
automation-eda-controller (Red Hat package)
ansible-rulebook (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
createrepo_c (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
rubygem-foreman_maintain (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-rhsm (Red Hat package)
python-productmd (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-grpcio (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
rhui-cds-plugin-mirror (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-authorizer (Red Hat package)
python-urlman (Red Hat package)
python-xlrd (Red Hat package)
python-charset-normalizer (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pygtrie (Red Hat package)
python-pyjwt (Red Hat package)
python3-docker
python-dateutil (Red Hat package)
python-requests
python3-requests
ansible-core (Red Hat package)
python-requests (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pycparser (Red Hat package)
python2-requests
python-requests-help
python3-requests+security
python3-requests+socks
python-requests-doc
python311-requests
mingw-python-requests
python3x-requests (Red Hat package)
python-oci
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python-dynaconf (Red Hat package)
python-psycopg_c (Red Hat package)
python-psycopg (Red Hat package)
python-tablib (Red Hat package)
python-django-guid (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp (Red Hat package)
python3x-aiohttp (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulp-rpm (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
oci-cli
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python-django (Red Hat package)
python-redis (Red Hat package)
candlepin (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
python3x-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python-jsonschema (Red Hat package)
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
rubygem-katello (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-pyyaml (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
satellite (Red Hat package)
python311-docker
python-click (Red Hat package)
rubygem-foreman_openscap (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
rubygem-foreman_remote_execution (Red Hat package)
rubygem-foreman_theme_satellite (Red Hat package)
rubygem-foreman_ansible (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-pip (Ubuntu package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-certifi (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
watsonx.data
OpenShift Service Mesh
Multicluster Engine for Kubernetes
OpenShift Virtualization
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Qradar SIEM
Red Hat Ceph Storage
IBM InfoSphere Information Server

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the session object does not verify requests after making first request with verify=False. A local administrator can bypass authentication.

Install updates from vendor's website.

• https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
• https://github.com/psf/requests/pull/6655
• https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac