https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:33:27 +0000 https://vulnerability.circl.lu/vuln/brew-abi3audit-cve-2024-35195 <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> https://vulnerability.circl.lu/vuln/brew-abi3audit-cve-2024-35195 https://vulnerability.circl.lu/vuln/cve-2024-35195 <p><strong>Affected:</strong> psf requests, request_project request</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> <p><strong>Affected:</strong> psf requests, request_project request</p> <p>Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.</p> https://vulnerability.circl.lu/vuln/cve-2024-35195 https://vulnerability.circl.lu/vuln/ghsa-9wx4-h78v-vm56 <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> <p><strong>Affected:</strong> PyPI: requests</p> <p>When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.</p> <p>This occurs because the underlying connection is reused from the session&#39;s connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.</p> <p>This behavior affects versions of `requests` prior to 2.32.0.</p> https://vulnerability.circl.lu/vuln/ghsa-9wx4-h78v-vm56