Security features bypass in Requests - CVE-2024-35195

Vulnerability identifier: #VU90156

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-35195

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the session object does not verify requests after making first request with verify=False. A local administrator can bypass authentication.

Requests
Oracle Solaris
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Availability Extension 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Manager Client Tools for SLE
Public Cloud Module
Advanced Systems Management Module
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Python 3 Module
openSUSE Leap
openEuler
Ubuntu
Fedora
IBM Cloud Pak for Data System
IBM Concert Software
Cryostat
IBM Watson Knowledge Catalog in Cloud Pak for Data
Red Hat Satellite
IBM Spectrum Protect Plus
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core DBTier
IBM Observability with Instana
Multicluster GlobalHub
IBM Process Mining
Ansible Automation Platform
Qradar Advisor
IBM Fusion HCI
Red Hat Advanced Cluster Management for Kubernetes
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Decision Optimization for Cloud Pak for Data
Red Hat Update Infrastructure (RHUI)
App Connect Enterprise Certified Container
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
IBM Sterling Connect:Direct Web Services
IBM Maximo Application Suite
Red Hat OpenStack
IBM Robotic Process Automation
IBM Business Automation Workflow
Netezza Appliance
Oracle Utilities Network Management System
Guardium Data Security Center (GDSC)
IBM Cloud Pak for Watson AIOps
Oracle Communications Operations Monitor
WatsonX BI Assistant
Oracle Business Intelligence Enterprise Edition
Maximo Application Suite - Predict Component
Oracle Communications Policy Management
Business Automation Insights
PowerVault ME5
APEX Cloud Platform for Microsoft Azure
QRadar App SDK
Data Observability by Databand Self-Hosted
QRadar Deployment Intelligence App
Security QRadar EDR
Storage Resource Manager
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
SOAR QRadar Plugin App
Db2 Big SQL
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Storage Protect Plus File Systems Agent
IBM Netezza for Cloud Pak for Data
Robotic Process Automation for Cloud Pak
Voice Gateway
Communications Unified Assurance
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Nautobot
Oracle Financial Services Compliance Studio
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Oracle Banking Liquidity Management
QRadar Suite
Splunk Enterprise
Juniper Secure Analytics (JSA)
Python for Scientific Computing
Traffix SDC
QRadar Manager for YARA and SIGMA Rules App
Red Hat OpenShift Container Platform
MySQL Cluster
PeopleSoft Enterprise PeopleTools
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository
libcomps (Red Hat package)
aap-metrics-utility (Red Hat package)
crosswords
crosswords-puzzle-sets-xword-dl
python-json-stream-rs-tokenizer (Red Hat package)
python-iniparse (Red Hat package)
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-drf-spectacular (Red Hat package)
python-pulp-cli (Red Hat package)
python-pulp-glue (Red Hat package)
m2crypto (Red Hat package)
python-drf-nested-routers (Red Hat package)
scap-security-guide-satellite (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
python-asyncio-throttle (Red Hat package)
automation-eda-controller (Red Hat package)
ansible-rulebook (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
createrepo_c (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
rubygem-foreman_maintain (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-rhsm (Red Hat package)
python-productmd (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-grpcio (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-mirror (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
rhui-cds-plugin-authorizer (Red Hat package)
python-urlman (Red Hat package)
python-xlrd (Red Hat package)
python-charset-normalizer (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pyjwt (Red Hat package)
python-pygtrie (Red Hat package)
python3-docker
python-dateutil (Red Hat package)
python-requests
python3-requests
ansible-core (Red Hat package)
python-requests (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pycparser (Red Hat package)
python2-requests
python-requests-help
python-requests-doc
python3-requests+security
python3-requests+socks
python311-requests
mingw-python-requests
python3x-requests (Red Hat package)
python-oci
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python-dynaconf (Red Hat package)
python-psycopg (Red Hat package)
python-psycopg_c (Red Hat package)
python-django-guid (Red Hat package)
python-tablib (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp (Red Hat package)
python3x-aiohttp (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulp-rpm (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
oci-cli
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
python-django (Red Hat package)
python-redis (Red Hat package)
candlepin (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
python3x-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python-jsonschema (Red Hat package)
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
rubygem-katello (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-pyyaml (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
satellite (Red Hat package)
python311-docker
python-click (Red Hat package)
rubygem-foreman_openscap (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
rubygem-foreman_remote_execution (Red Hat package)
rubygem-foreman_theme_satellite (Red Hat package)
rubygem-foreman_ansible (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-pip (Ubuntu package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-certifi (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
watsonx.data
OpenShift Service Mesh
Multicluster Engine for Kubernetes
OpenShift Virtualization
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Qradar SIEM
Red Hat Ceph Storage
IBM InfoSphere Information Server

Install updates from vendor's website.

Requests - update to 2.32.0
Oracle Solaris - update to 11.4 SRU 71
IBM Cloud Pak for Data System - update to 1.0.9.0
Netezza Appliance - update to 1.0.0.1
IBM Concert Software - update to 1.1.0
Voice Gateway - update to 1.0.8.12
Nautobot - addressed in versions 1.6.23, 2.2.5
QRadar Suite - update to 1.10.25.0
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Python for Scientific Computing - update to 4.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Traffix SDC - update to 5.2.0
WatsonX BI Assistant - update to 5.2.2
Red Hat Satellite - update to 6.16.3
MySQL Cluster - addressed in versions 8.0.41, 8.4.4
Maximo Application Suite - Predict Component - update to 9.0.1
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
IBM Spectrum Protect Plus - update to 10.1.17.1
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
IBM Observability with Instana - update to 279
libcomps (Red Hat package) - update to 0.1.21-1.el8ui
aap-metrics-utility (Red Hat package) - addressed in versions 0.3.0-1.el8ap, 0.3.0-1.el9ap
crosswords - update to 0.3.13.3-4.fc41
crosswords-puzzle-sets-xword-dl - addressed in versions 0.4.8-1.fc41, 0.4.8-1.fc42, 0.4.8-1.fc43
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-4.el8ui
python-iniparse (Red Hat package) - update to 0.4-40.0.1.el8ui
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - addressed in versions 0.5.0-1.el9ap, 0.5.0-1.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-5.el8ui
python-inflection (Red Hat package) - update to 0.5.1-7.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-7.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-5.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-6.el8ui
python-future (Red Hat package) - update to 0.18.3-5.el8ui
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
python-drf-spectacular (Red Hat package) - update to 0.26.5-5.el8ui
python-pulp-cli (Red Hat package) - addressed in versions 0.29.2-2.el8pc, 0.29.2-2.el9pc
python-pulp-glue (Red Hat package) - addressed in versions 0.29.2-2.el8pc, 0.29.2-2.el9pc, 0.29.2-2.el8ui
m2crypto (Red Hat package) - update to 0.40.1-1.0.2.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-6.el8ui
scap-security-guide-satellite (Red Hat package) - addressed in versions 1.0.0-1.el8sat, 1.0.0-1.el9sat
python-django-lifecycle (Red Hat package) - update to 1.0.0-4.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-8.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-7.el8ui
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
python-brotli (Red Hat package) - update to 1.0.9-6.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-6.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-4.el8ui
createrepo_c (Red Hat package) - update to 1.1.3-1.0.1.el8ui
PowerVault ME5 - update to 1.2.2.1
python-deprecated (Red Hat package) - update to 1.2.13-5.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-4.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-7.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-5.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-5.el8ui
Multicluster GlobalHub - update to 1.4.1
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
python-odfpy (Red Hat package) - update to 1.4.1-10.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-9.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-8.el8ui
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-6.el8ui
python-jq (Red Hat package) - update to 1.6.0-4.el8ui
rubygem-foreman_maintain (Red Hat package) - addressed in versions 1.7.12-1.el8sat, 1.7.12-1.el9sat
python-yarl (Red Hat package) - update to 1.8.2-5.el8ui
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
python-wrapt (Red Hat package) - update to 1.14.1-5.el8ui
python-markuppy (Red Hat package) - update to 1.14-7.el8ui
IBM Process Mining - update to 1.15.0 IF001
python-rhsm (Red Hat package) - update to 1.19.2-7.0.1.el8ui
python-productmd (Red Hat package) - update to 1.33-7.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-5.el8ui
python-grpcio (Red Hat package) - update to 1.65.4-1.el8ui
rhui-cds-plugin-fetcher (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-mirror (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer-cert (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer (Red Hat package) - update to 2.0.0-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-9.el8ui
watsonx.data - update to 2.1
python-charset-normalizer (Red Hat package) - update to 2.1.1-5.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-5.el8ui
QRadar Manager for YARA and SIGMA Rules App - update to 2.2.0
python-backoff (Red Hat package) - update to 2.2.1-5.el8ui
QRadar App SDK - update to 2.2.2
python-urllib3 (Red Hat package) - update to 2.2.3-1.el8ui
Ansible Automation Platform - addressed in versions 2.4, 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
OpenShift Service Mesh - addressed in versions 2.4.14, 2.5.8, 2.6.5
python-pyjwt (Red Hat package) - update to 2.5.0-5.el8ui
python-pygtrie (Red Hat package) - update to 2.5.0-5.el8ui
python3-docker - update to 2.6.1-150000.4.3.1
Qradar Advisor - update to 2.6.6
Multicluster Engine for Kubernetes - update to 2.6.8
python-dateutil (Red Hat package) - update to 2.8.2-7.el8ui
IBM Fusion HCI - update to 2.9.0
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.9.6, 2.13.3
python-requests - addressed in versions 2.11.1-6.37.1, 2.11.1-6.40.1, 2.24.0-8.17.1, 2.24.0-8.20.1
python3-requests - addressed in versions 2.11.1-6.37.1, 2.11.1-6.40.1, 2.24.0-8.17.1, 2.24.0-8.20.1, 2.25.1-150300.3.9.1
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap, 2.15.12-1.el8ap, 2.15.12-1.el9ap
python3-requests - addressed in versions 2.20.0-5, 2.31.0-3
python-requests (Red Hat package) - addressed in versions 2.20.0-5.el8_10, 2.25.1-2.el8ost, 2.32.2-1.el9ap, 2.32.3-2.el8pc, 2.32.3-2.el9pc, 2.32.3-2.el8ui
python-pulp-container (Red Hat package) - addressed in versions 2.20.3-1.el8ui, 2.20.5-1.el8pc, 2.20.5-1.el9pc
python-pulp-container-client (Red Hat package) - update to 2.21.0-1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.21.1-1.el8ui
python-pycparser (Red Hat package) - update to 2.21-6.el8ui
python2-requests - update to 2.24.0-5
python3-requests - addressed in versions 2.24.0-5, 2.26.0-11, 2.31.0-4
python-requests - addressed in versions 2.24.0-5, 2.26.0-11, 2.31.0-4
python-requests-help - addressed in versions 2.24.0-5, 2.26.0-11, 2.31.0-4
python-requests-doc - update to 2.31.0-3
python3-requests+security - update to 2.31.0-3
python3-requests+socks - update to 2.31.0-3
python311-requests - update to 2.31.0-150400.6.15.1
Data Observability by Databand Self-Hosted - update to 2.32.0
mingw-python-requests - addressed in versions 2.32.0-1.fc39, 2.32.0-1.fc40
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests - update to 2.32.3-1.fc41
python-oci - update to 2.126.4-1.fc41
python-aiodns (Red Hat package) - update to 3.0.0-7.el8ui
QRadar Deployment Intelligence App - update to 3.0.16
python-django-import-export (Red Hat package) - update to 3.1.0-4.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-5.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-4.el8ui
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - addressed in versions 3.1.4-1.el9ap, 3.1.4-1.el8ui, 3.1.5-1.el8pc, 3.1.5-1.el9pc
python-dynaconf (Red Hat package) - update to 3.1.12-4.el8ui
python-psycopg (Red Hat package) - update to 3.2.3-1.el8ui
python-psycopg_c (Red Hat package) - update to 3.2.3-1.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-5.el8ui
python-tablib (Red Hat package) - update to 3.3.0-5.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-5.el8ui
python-zipp (Red Hat package) - update to 3.4.0-8.el8ui
APEX Cloud Platform for Red Hat OpenShift - update to 03.04.01.00
python-asgiref (Red Hat package) - update to 3.6.0-5.el8ui
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python-aiohttp (Red Hat package) - addressed in versions 3.9.4-1.el8ui, 3.9.5-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
foreman-installer (Red Hat package) - addressed in versions 3.12.0.4-2.el8sat, 3.12.0.4-2.el9sat
foreman (Red Hat package) - addressed in versions 3.12.0.6-1.el8sat, 3.12.0.6-1.el9sat
Security QRadar EDR - update to 3.12.9
python-djangorestframework (Red Hat package) - update to 3.14.0-4.el8ui
python-pycryptodomex (Red Hat package) - update to 3.20.0-1.el8ui
Red Hat OpenShift Dev Spaces - update to 3.21.0
python-pulp-rpm-client (Red Hat package) - update to 3.25.4-1.0.1.el8ui
python-pulp-rpm (Red Hat package) - update to 3.26.1-1.el8ui
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el9ap, 3.49.22-1.el8ui, 3.49.33-1.el8pc, 3.49.33-1.el9pc
oci-cli - update to 3.41.0-1.fc41
python-pulpcore-client (Red Hat package) - update to 3.49.19-1.0.2.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-6.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-6.el8ui
python-pycares (Red Hat package) - update to 4.1.2-6.el8ui
python-django (Red Hat package) - addressed in versions 4.2.15-1.el8ui, 4.2.19-1.el8pc, 4.2.19-1.el9pc
python-redis (Red Hat package) - update to 4.3.4-5.el8ui
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.4.8, 4.6.2
candlepin (Red Hat package) - addressed in versions 4.4.21-1.el8sat, 4.4.21-1.el9sat
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap, 4.5.8-1.el8ap, 4.5.8-1.el9ap
python-typing-extensions (Red Hat package) - update to 4.7.1-5.el8ui
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
python-jsonschema (Red Hat package) - update to 4.10.3-4.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.11.0
rhui-installer (Red Hat package) - update to 4.11.0.2-1.el8ui
rhui-tools (Red Hat package) - update to 4.11.0.4-1.el8ui
rubygem-katello (Red Hat package) - addressed in versions 4.14.0.8-1.el8sat, 4.14.0.8-1.el9sat
OpenShift Virtualization - update to 4.15.9
Red Hat OpenShift Container Platform - update to 4.15.43
python-protobuf (Red Hat package) - update to 4.21.6-5.el8ui
Storage Resource Manager - update to 5.0.2.2
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.2
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.2.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1.1
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python-pyyaml (Red Hat package) - update to 5.4.1-8.0.1.el8ui
SOAR QRadar Plugin App - update to 5.5.0
OpenShift Logging - update to 5.6.27
python-whitenoise (Red Hat package) - update to 6.0.0-5.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-5.el8ui
python-multidict (Red Hat package) - update to 6.0.4-5.el8ui
IBM Sterling Connect:Direct Web Services - update to 6.3.0.11 ifix001
satellite (Red Hat package) - addressed in versions 6.16.3-2.el8sat, 6.16.3-2.el9sat
python311-docker - update to 7.0.0-150400.8.7.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
Db2 Big SQL - update to 7.7.3
Red Hat Ceph Storage - update to 8.1
python-click (Red Hat package) - update to 8.1.3-5.el8ui
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.10.21, 8.11.18, 9.0.7
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.8, 9.0.2
rubygem-foreman_openscap (Red Hat package) - addressed in versions 9.0.5-1.el8sat, 9.0.5-1.el9sat
Storage Protect Plus File Systems Agent - update to 10.1.16.3
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
rubygem-foreman_remote_execution (Red Hat package) - addressed in versions 13.2.7-1.el8sat, 13.2.7-1.el9sat
rubygem-foreman_theme_satellite (Red Hat package) - addressed in versions 13.3.5-1.el8sat, 13.3.5-1.el9sat
rubygem-foreman_ansible (Red Hat package) - addressed in versions 14.2.3-1.el8sat, 14.2.3-1.el9sat
Red Hat OpenStack - update to 17.1.4
Robotic Process Automation for Cloud Pak - update to 21.0.7.19
IBM Robotic Process Automation - update to 21.0.7.19
python-packaging (Red Hat package) - update to 21.3-6.el8ui
python-attrs (Red Hat package) - update to 21.4.0-6.el8ui
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el9ap, 22.0.0-1.0.1.el8ui
python-pip (Ubuntu package) - addressed in versions 22.0.2+dfsg-1ubuntu0.7+esm1, 22.0.2+dfsg-1ubuntu0.7+esm2, 24.0+dfsg-1ubuntu1.3+esm1, 24.0+dfsg-1ubuntu1.3+esm2, 25.1.1+dfsg-1ubuntu2+esm1, 25.1.1+dfsg-1ubuntu2+esm2
python-aiofiles (Red Hat package) - update to 22.1.0-5.el8ui
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
IBM Business Automation Workflow - update to 23.0.2 IF006
python-django-filter (Red Hat package) - update to 23.2-4.el8ui
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - addressed in versions 24.1.0-1.el9ap, 24.1.0-1.el8ui
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - addressed in versions 42.0.5-1.el9ap, 42.0.8-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-6.el8ui
python-certifi (Red Hat package) - update to 2022.12.7-5.0.1.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-5.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-7.el8ui

• https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
• https://github.com/psf/requests/pull/6655
• https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac

• Security features bypass in Requests
• Multiple vulnerabilities in Nautobot
• Fedora 41 update for oci-cli, python-oci
• Fedora 40 update for mingw-python-requests
• Fedora 39 update for mingw-python-requests
• SUSE update for python-docker
• SUSE update for python-requests
• SUSE update for python-requests
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Fedora 41 update for python-requests
• SUSE update for python-docker
• Security features bypass in IBM InfoSphere Information Server
• SUSE update for python-docker
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• SUSE update for python-requests
• Splunk Python for Scientific Computing update for third-party packages
• Multiple vulnerabilities in IBM Security QRadar EDR
• Security features bypass in IBM Business Automation Workflow
• Multiple vulnerabilities in QRadar Manager for YARA and SIGMA Rules App
• Security features bypass in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Observability with Instana
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in IBM QRadar Suite software
• Security features bypass in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Process Mining
• F5 Traffix SDC update for Python Requests
• Fedora 41 update for crosswords
• Multiple vulnerabilities in IBM Storage Protect Plus File Systems Agent
• IBM Data Observability by Databand Self-Hosted update for Psf Requests
• SUSE update for Recommended update for python-requests
• SUSE update for Recommended update for python-requests
• SUSE update for Recommended update for python-requests
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM Edge Data Collector update for Psf Requests
• Security features bypass in Red Hat OpenStack 17.1
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Fusion HCI Installer
• Multiple vulnerabilities in IBM Fusion HCI
• IBM Sterling Connect:Direct Web Service update for python-requests
• Red Hat Enterprise Linux 8 update for python-requests
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• Red Hat Cryostat 3 update for golang
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Oracle Communications Cloud Native Core DBTier
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.9
• Multiple vulnerabilities in Communications Unified Assurance
• Security features bypass in Oracle Communications Offline Mediation Controller
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• IBM watsonx.data update for Psf Requests
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• IBM Maximo Application Suite - Monitor Component update for Psf Requests
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Psf Requests
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Psf Requests
• Multiple vulnerabilities in OpenShift Virtualization 4.15
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Satellite 6.16
• Anolis OS update for python-requests
• Anolis OS update for python-requests
• Fedora 43 update for crosswords-puzzle-sets-xword-dl
• Fedora 42 update for crosswords-puzzle-sets-xword-dl
• Fedora 41 update for crosswords-puzzle-sets-xword-dl
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• IBM Maximo Application Suite update for Psf Requests
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Policy Management
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• IBM Cloud Pak for Data System 1.0 update for Psf Requests
• Juniper Secure Analytics update for third-party components
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Multicluster GlobalHub 1.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in MySQL Cluster
• openEuler 20.03 LTS SP4 update for python-requests
• openEuler 24.03 LTS SP1 update for python-requests
• openEuler 24.03 LTS update for python-requests
• openEuler 22.03 LTS SP4 update for python-requests
• Multiple vulnerabilities in IBM WatsonX BI Assistant for CP4D
• IBM Netezza Appliance update for Requests
• Multiple vulnerabilities in IBM Big SQL on Cloud Pak for Data
• openEuler 24.03 LTS SP2 update for python-requests
• openEuler 22.03 LTS SP3 update for python-requests
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.21
• Ubuntu update for python-pip
• Ubuntu update for python-pip
• Multiple vulnerabilities in Dell PowerVault ME5