CVE-2024-35195

{
  "id": "CVE-2024-35195",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35195",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-30T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "psf",
          "product": "requests",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.32.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:request_project:request:2.32.0:*:*:*:*:node.js:*:*"
          ],
          "vendor": "request_project",
          "product": "request",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.32.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-20T21:15:09.990",
  "references": [
    {
      "url": "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/psf/requests/pull/6655",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/psf/requests/pull/6655",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0."
    },
    {
      "lang": "es",
      "value": " Requests es una librería HTTP. Antes de 2.32.0, al realizar solicitudes a través de una `Sesión` de Solicitudes, si la primera solicitud se realiza con `verify=False` para deshabilitar la verificación de certificados, todas las solicitudes posteriores al mismo host continuarán ignorando la verificación de certificados independientemente de los cambios en el valor de \"verificar\". Este comportamiento continuará durante el ciclo de vida de la conexión en el grupo de conexiones. Esta vulnerabilidad se solucionó en 2.32.0."
    }
  ],
  "lastModified": "2026-06-17T07:34:31.230",
  "sourceIdentifier": "security-advisories@github.com"
}