Bug 2371272 (CVE-2024-47081)

Summary: CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, adinn, adistefa, adudiak, agarcial, alinfoot, anthomas, aoconnor, aprice, asegurap, bbrownin, bdettelb, brasmith, caswilli, cochase, crizzo, dfreiber, dhanak, dnakabaa, doconnor, dranck, drosa, drow, dsimansk, dtrifiro, eglynn, ehelms, fzakkak, galder.zamarreno, ggainey, haoli, hkataria, jajackso, jburrell, jcammara, jchui, jdobes, jhe, jjoyce, jkoehler, jmitchel, jneedle, jsamir, jschluet, jtanner, juwatts, jwendell, jwong, jwright, kaycoth, kegrant, kgaikwad, kholdawa, kingland, koliveir, kshier, ktsao, kverlaen, lball, lbrazdil, lchilton, lcouzens, lgamliel, lhh, ljawale, lphiri, lsvaty, luizcosta, mabashia, matzew, mbabacek, mburns, mgarciac, mhulan, mminar, mnovotny, mskarbek, nboldt, ngough, nmoumoul, nweather, oezr, olubyans, omaciel, orabin, osousa, pakotvan, pbraun, pcreech, pgrist, pjindal, psrna, rbiba, rbobbitt, rbryant, rcernich, rchan, rfreiman, sausingh, sbiarozk, sdoran, sfeifer, sgehwolf, shvarugh, simaishi, smallamp, smcdonal, sskracic, stcannon, sthirugn, teagle, tfister, thavo, tmalecek, tpfromme, tqvarnst, ttakamiy, veshanka, vkrizan, vkumar, weaton, xiaoxwan, yguenane, zdohnal, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2372471, 2372473, 2372477, 2372472, 2372474, 2372475, 2372476, 2372478, 2372479, 2375883, 2375884, 2375885, 2375886    
Bug Blocks:    

Description OSIDB Bzimport 2025-06-09 19:01:12 UTC
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

Comment 7 errata-xmlrpc 2025-08-04 01:59:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:12519 https://access.redhat.com/errata/RHSA-2025:12519

Comment 8 errata-xmlrpc 2025-08-06 12:32:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:13234 https://access.redhat.com/errata/RHSA-2025:13234

Comment 10 errata-xmlrpc 2025-08-11 10:21:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:13604 https://access.redhat.com/errata/RHSA-2025:13604

Comment 12 errata-xmlrpc 2025-08-27 13:44:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:14750 https://access.redhat.com/errata/RHSA-2025:14750

Comment 13 errata-xmlrpc 2025-09-02 02:47:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:14999 https://access.redhat.com/errata/RHSA-2025:14999

Comment 14 errata-xmlrpc 2025-09-03 13:11:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:15121 https://access.redhat.com/errata/RHSA-2025:15121

Comment 15 errata-xmlrpc 2025-09-03 13:17:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:15122 https://access.redhat.com/errata/RHSA-2025:15122

Comment 17 errata-xmlrpc 2025-09-10 12:18:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:15618 https://access.redhat.com/errata/RHSA-2025:15618

Comment 18 errata-xmlrpc 2025-09-10 12:19:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:15616 https://access.redhat.com/errata/RHSA-2025:15616

Comment 19 errata-xmlrpc 2025-09-10 12:19:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:15617 https://access.redhat.com/errata/RHSA-2025:15617

Comment 20 errata-xmlrpc 2025-09-10 12:23:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:15614 https://access.redhat.com/errata/RHSA-2025:15614

Comment 21 errata-xmlrpc 2025-09-10 12:24:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:15615 https://access.redhat.com/errata/RHSA-2025:15615

Comment 22 errata-xmlrpc 2025-09-10 12:53:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:15622 https://access.redhat.com/errata/RHSA-2025:15622

Comment 23 errata-xmlrpc 2025-09-11 13:34:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:15691 https://access.redhat.com/errata/RHSA-2025:15691

Comment 24 errata-xmlrpc 2025-09-15 01:14:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:15723 https://access.redhat.com/errata/RHSA-2025:15723