CVE catalog

CVE-2023-32681

pip vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.97% · Oct 25, 2026

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrequestssid2.34.2-1fixed
Debianrequestsforky2.34.2-1fixed
Debianrequeststrixie2.32.3+dfsg-5+deb13u1fixed
Debianrequestsbookworm2.28.1+dfsg-1vulnerable
UbunturequestsnobleNot reportedvulnerable
Ubuntupython-pipnoble24.0+dfsg-1ubuntu1.3fixed
Ubuntupython3-pipnoble24.0+dfsg-1ubuntu1.3fixed
Ubuntupython3-pip-whlnoble24.0+dfsg-1ubuntu1.3fixed
Ubunturequestsnoble2.31.0+dfsg-1ubuntu1.1fixed
Ubuntupython-requests-docnoble2.31.0+dfsg-1ubuntu1.1fixed
Ubuntupython3-requestsnoble2.31.0+dfsg-1ubuntu1.1fixed
PyPIrequestsNot reported2.31.0fixed
PyPIrequestsNot reported2.31.0fixed
PyPIrequestsNot reported74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5fixed
Ubunturequestspro2.21.0-1vulnerable
Ubunturequestspro2.22.0-2build1vulnerable
Ubunturequestspro2.22.0-2ubuntu1vulnerable
Ubunturequestspro2.22.0-2ubuntu1.1vulnerable
Ubunturequestspro2.22.0-2ubuntu1.1+esm1fixed
Ubunturequests22.042.25.1+dfsg-2vulnerable
Ubunturequests22.042.25.1+dfsg-2ubuntu0.1vulnerable
Ubunturequests22.042.25.1+dfsg-2ubuntu0.3fixed
Ubunturequests24.042.31.0+dfsg-1ubuntu1vulnerable
Ubunturequests24.042.31.0+dfsg-1ubuntu1.1fixed
Ubunturequestspro2.18.1-1vulnerable
Ubunturequestspro2.18.4-1vulnerable
Ubunturequestspro2.18.4-2vulnerable
Ubunturequestspro2.18.4-2ubuntu0.1vulnerable
Ubunturequestspro2.18.4-2ubuntu0.1+esm1fixed
Ubuntupython-pip22.0420.3.4-4vulnerable
Ubuntupython-pip22.0421.3.1+dfsg-3vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.1vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.2vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.3vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.4vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.5vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.6vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.7fixed
Ubuntupython-pip24.0423.2+dfsg-1vulnerable
Ubuntupython-pip24.0423.3+dfsg-1vulnerable
Ubuntupython-pip24.0424.0+dfsg-1vulnerable
Ubuntupython-pip24.0424.0+dfsg-1ubuntu1vulnerable
Ubuntupython-pip24.0424.0+dfsg-1ubuntu1.1vulnerable
Ubuntupython-pip24.0424.0+dfsg-1ubuntu1.2vulnerable
Ubuntupython-pip24.0424.0+dfsg-1ubuntu1.3fixed
Ubunturequests20.042.21.0-1vulnerable
Ubunturequests20.042.22.0-2build1vulnerable
Ubunturequests20.042.22.0-2ubuntu1vulnerable
Ubunturequests20.042.22.0-2ubuntu1.1fixed
Ubunturequests22.042.25.1+dfsg-2vulnerable
Ubunturequests22.042.25.1+dfsg-2ubuntu0.1fixed
Susepython-requestslinux enterprise high availability extension 12 sp52.24.0-8.14.1fixed
Susepython-requestslinux enterprise module for public cloud 122.24.0-8.14.1fixed
Susepython-requestslinux enterprise server 12 sp52.24.0-8.14.1fixed
Susepython-requestslinux enterprise server for sap applications 12 sp52.24.0-8.14.1fixed
Susepython3-requestslinux enterprise software development kit 12 sp52.24.0-8.17.1fixed
Susepython3-requestslinux enterprise server 12 sp52.24.0-8.17.1fixed
Susepython3-requestslinux enterprise server for sap applications 12 sp52.24.0-8.17.1fixed
Susepython3-requestslinux enterprise workstation extension 12 sp52.24.0-8.17.1fixed
Opensusepython-requeststumbleweed2.31.0-1.2fixed
Opensuseoci-clitumbleweed3.54.1-1.1fixed
Susepython-requestslinux enterprise micro 5.32.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise micro 5.42.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise module for basesystem 15 sp42.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise module for basesystem 15 sp52.24.0-150300.3.3.1fixed
Susepython-requestsmanager proxy 4.22.24.0-150300.3.3.1fixed
Susepython-requestsmanager server 4.22.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise micro 5.12.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise micro 5.22.24.0-150300.3.3.1fixed
Opensusepython-requestsleap 15.42.24.0-150300.3.3.1fixed
Opensusepython-requestsleap 15.52.24.0-150300.3.3.1fixed
Ubunturequestspro2.18.1-1vulnerable
Ubunturequestspro2.18.4-1vulnerable
Ubunturequestspro2.18.4-2vulnerable
Ubunturequestspro2.18.4-2ubuntu0.1vulnerable
Ubunturequestspro2.18.4-2ubuntu0.1+esm1fixed
Ubuntupython-pip20.0418.1-5vulnerable
Ubuntupython-pip20.0418.1-5build1vulnerable
Ubuntupython-pip20.0418.1-5ubuntu1vulnerable
Ubuntupython-pip20.0420.0.2-2vulnerable
Ubuntupython-pip20.0420.0.2-4vulnerable
Ubuntupython-pip20.0420.0.2-5vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.1vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.3vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.4vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.5vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.6vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.7vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.8vulnerable
Ubuntupython-pip20.0420.0.2-5ubuntu1.9fixed
Ubunturequests20.042.21.0-1vulnerable
Ubunturequests20.042.22.0-2build1vulnerable
Ubunturequests20.042.22.0-2ubuntu1vulnerable
Ubunturequests20.042.22.0-2ubuntu1.1fixed
Ubuntupython-pip22.0420.3.4-4vulnerable
Ubuntupython-pip22.0421.3.1+dfsg-3vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.1vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.2vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.3vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.4vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.5vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.6vulnerable
Ubuntupython-pip22.0422.0.2+dfsg-1ubuntu0.7fixed
Ubunturequests22.042.25.1+dfsg-2vulnerable
Ubunturequests22.042.25.1+dfsg-2ubuntu0.1fixed
Susepython-requestslinux enterprise real time 15 sp32.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp3-ltss2.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise server 15 sp3-ltss2.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp32.24.0-150300.3.3.1fixed
Susepython-requestsenterprise storage 7.12.24.0-150300.3.3.1fixed
Opensusepython-requestsleap micro 5.32.24.0-150300.3.3.1fixed
Susepython-requestslinux enterprise module for public cloud 15 sp12.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp1-ltss2.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp2-ltss2.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise server 15 sp1-ltss2.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise server 15 sp2-ltss2.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp12.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp22.25.1-150100.6.16.1fixed
Susepython-requestsenterprise storage 72.25.1-150100.6.16.1fixed
Susepython-requestslinux enterprise high availability extension 12 sp42.11.1-6.34.1fixed
Susepython-requestsmanager client tools 122.11.1-6.34.1fixed
Susepython-requestslinux enterprise module for advanced systems management 122.11.1-6.34.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrequestssourcesid2.31.0+dfsg-1not yet assignedNot reported[1036693]
Debianrequestssourceforky2.31.0+dfsg-1not yet assignedNot reported[1036693]
Debianrequestssourcetrixie2.31.0+dfsg-1not yet assignedNot reported[1036693]
Debianrequestssourcebookworm(unfixed)not yet assignedNot reported[1036693]
Ubuntupython-pipdebnoble24.0+dfsg-1ubuntu1.3Not reportedNot reportedNot reported
Ubuntupython3-pipdebnoble24.0+dfsg-1ubuntu1.3Not reportedNot reportedNot reported
Ubuntupython3-pip-whldebnoble24.0+dfsg-1ubuntu1.3Not reportedNot reportedNot reported
Ubunturequestsdebnoble2.31.0+dfsg-1ubuntu1.1Not reportedNot reportedNot reported
Ubuntupython-requests-docdebnoble2.31.0+dfsg-1ubuntu1.1Not reportedNot reportedNot reported
Ubuntupython3-requestsdebnoble2.31.0+dfsg-1ubuntu1.1Not reportedNot reportedNot reported
PyPIrequestsPyPINot reported2.31.0Not reportedGHSA-J8R2-6X86-Q33QNot reported
PyPIrequestsPyPINot reported2.31.0Not reportedNot reportedNot reported
PyPIrequestsPyPINot reported74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5Not reportedNot reportedNot reported
Ubunturequestsdebpro2.22.0-2ubuntu1.1+esm1Not reportedUSN-7568-1Not reported
Ubunturequestsdeb22.042.25.1+dfsg-2ubuntu0.3Not reportedUSN-7568-1Not reported
Ubunturequestsdeb24.042.31.0+dfsg-1ubuntu1.1Not reportedUSN-7568-1Not reported
Ubunturequestsdebpro2.18.4-2ubuntu0.1+esm1Not reportedUSN-6155-2Not reported
Ubuntupython-pipdeb22.0422.0.2+dfsg-1ubuntu0.7Not reportedUSN-7762-1Not reported
Ubuntupython-pipdeb24.0424.0+dfsg-1ubuntu1.3Not reportedUSN-7762-1Not reported
Ubunturequestsdeb20.042.22.0-2ubuntu1.1Not reportedUSN-6155-1Not reported
Ubunturequestsdeb22.042.25.1+dfsg-2ubuntu0.1Not reportedUSN-6155-1Not reported
Susepython-requestsrpmlinux enterprise high availability extension 12 sp52.24.0-8.14.1Not reportedSUSE-SU-2023:2638-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 122.24.0-8.14.1Not reportedSUSE-SU-2023:2638-1Not reported
Susepython-requestsrpmlinux enterprise server 12 sp52.24.0-8.14.1Not reportedSUSE-SU-2023:2638-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 12 sp52.24.0-8.14.1Not reportedSUSE-SU-2023:2638-1Not reported
Susepython3-requestsrpmlinux enterprise software development kit 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2023:2883-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2023:2883-1Not reported
Susepython3-requestsrpmlinux enterprise server for sap applications 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2023:2883-1Not reported
Susepython3-requestsrpmlinux enterprise workstation extension 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2023:2883-1Not reported
Opensusepython-requestsrpmtumbleweed2.31.0-1.2Not reportedOPENSUSE-SU-2024:12998-1Not reported
Opensuseoci-clirpmtumbleweed3.54.1-1.1Not reportedOPENSUSE-SU-2025:14997-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.32.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.42.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmlinux enterprise module for basesystem 15 sp42.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmlinux enterprise module for basesystem 15 sp52.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmmanager proxy 4.22.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmmanager server 4.22.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.12.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.22.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Opensusepython-requestsrpmleap 15.42.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Opensusepython-requestsrpmleap 15.52.24.0-150300.3.3.1Not reportedSUSE-SU-2023:2866-1Not reported
Ubunturequestsdebpro2.18.4-2ubuntu0.1+esm1Not reportedUBUNTU-CVE-2023-32681Not reported
Ubuntupython-pipdeb20.0420.0.2-5ubuntu1.9Not reportedUBUNTU-CVE-2023-32681Not reported
Ubunturequestsdeb20.042.22.0-2ubuntu1.1Not reportedUBUNTU-CVE-2023-32681Not reported
Ubuntupython-pipdeb22.0422.0.2+dfsg-1ubuntu0.7Not reportedUBUNTU-CVE-2023-32681Not reported
Ubunturequestsdeb22.042.25.1+dfsg-2ubuntu0.1Not reportedUBUNTU-CVE-2023-32681Not reported
Susepython-requestsrpmlinux enterprise real time 15 sp32.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp3-ltss2.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Susepython-requestsrpmlinux enterprise server 15 sp3-ltss2.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp32.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Susepython-requestsrpmenterprise storage 7.12.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Opensusepython-requestsrpmleap micro 5.32.24.0-150300.3.3.1Not reportedSUSE-SU-2024:2685-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 15 sp12.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp1-ltss2.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp2-ltss2.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise server 15 sp1-ltss2.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise server 15 sp2-ltss2.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp12.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp22.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmenterprise storage 72.25.1-150100.6.16.1Not reportedSUSE-SU-2023:3094-1Not reported
Susepython-requestsrpmlinux enterprise high availability extension 12 sp42.11.1-6.34.1Not reportedSUSE-SU-2023:2865-1Not reported
Susepython-requestsrpmmanager client tools 122.11.1-6.34.1Not reportedSUSE-SU-2023:2865-1Not reported
Susepython-requestsrpmlinux enterprise module for advanced systems management 122.11.1-6.34.1Not reportedSUSE-SU-2023:2865-1Not reported

[Debian bug #1036693]

Notes

[bookworm] requests: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References