CVE catalog

CVE-2024-35195

pip vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 6CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrequestssid2.34.2-1fixed
Debianrequestsforky2.34.2-1fixed
Debianrequeststrixie2.32.3+dfsg-5+deb13u1fixed
Debianrequestsbookworm2.28.1+dfsg-1vulnerable
UbunturequestsnobleNot reportedvulnerable
Ubuntupython-pipnoble24.0+dfsg-1ubuntu1.3+esm1fixed
Ubuntupython3-pipnoble24.0+dfsg-1ubuntu1.3+esm1fixed
Ubuntupython3-pip-whlnoble24.0+dfsg-1ubuntu1.3+esm1fixed
PyPIrequestsNot reported2.32.0fixed
Alpinepy3-requests3.182.32.3-r0fixed
Alpinepy3-requests3.192.32.3-r0fixed
Alpinepy3-requests3.202.32.3-r0fixed
Alpinepy3-requests3.212.32.3-r0fixed
Alpinepy3-requests3.222.32.3-r0fixed
Alpinepy3-requests3.232.32.3-r0fixed
Alpinepy3-requests3.242.32.3-r0fixed
Ubuntupython-pippro25.1.1+dfsg-1ubuntu2vulnerable
Ubuntupython-pippro25.1.1+dfsg-1ubuntu2+esm1fixed
Susepython-requestslinux micro 6.02.32.3-1.1fixed
Susepython-requestslinux micro 6.02.32.2-1.1fixed
Susepython-dockermanager client tools 152.6.1-150000.4.3.1fixed
Susepython-dockerlinux enterprise module for package hub 15 sp54.2.0-150200.3.5.1fixed
Susepython-dockerlinux enterprise module for package hub 15 sp64.2.0-150200.3.5.1fixed
Opensusepython-dockerleap 15.54.2.0-150200.3.5.1fixed
Opensusepython-dockerleap 15.64.2.0-150200.3.5.1fixed
Susepython-requestslinux enterprise module for public cloud 15 sp42.31.0-150400.6.12.1fixed
Susepython-requestslinux enterprise module for python 3 15 sp52.31.0-150400.6.12.1fixed
Susepython-requestslinux enterprise module for python 3 15 sp62.31.0-150400.6.12.1fixed
Opensusepython-requestsleap 15.52.31.0-150400.6.12.1fixed
Opensusepython-requestsleap 15.62.31.0-150400.6.12.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp3-ltss2.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp4-espos2.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp4-ltss2.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise server 15 sp3-ltss2.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise server 15 sp4-ltss2.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp32.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp42.25.1-150300.3.9.1fixed
Susepython-requestsmanager proxy 4.32.25.1-150300.3.9.1fixed
Susepython-requestsmanager server 4.32.25.1-150300.3.9.1fixed
Susepython-requestsenterprise storage 7.12.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise module for public cloud 15 sp42.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise module for python 3 15 sp52.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise module for python 3 15 sp62.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp4-espos2.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise high performance computing 15 sp4-ltss2.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise server 15 sp4-ltss2.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise server for sap applications 15 sp42.31.0-150400.6.15.1fixed
Opensusepython-requestsleap 15.52.31.0-150400.6.15.1fixed
Opensusepython-requestsleap 15.62.31.0-150400.6.15.1fixed
Susepython-requestslinux enterprise high availability extension 12 sp52.24.0-8.20.1fixed
Susepython-requestslinux enterprise module for public cloud 122.24.0-8.20.1fixed
Susepython-requestslinux enterprise server 12 sp52.24.0-8.20.1fixed
Susepython-requestslinux enterprise server for sap applications 12 sp52.24.0-8.20.1fixed
Susepython-requestslinux enterprise high availability extension 12 sp52.24.0-8.17.1fixed
Susepython-requestslinux enterprise module for public cloud 122.24.0-8.17.1fixed
Susepython-requestslinux enterprise server 12 sp52.24.0-8.17.1fixed
Susepython-requestslinux enterprise server for sap applications 12 sp52.24.0-8.17.1fixed
Susepython-dockerlinux enterprise module for public cloud 15 sp67.0.0-150400.8.7.1fixed
Opensusepython-dockerleap 15.57.0.0-150400.8.7.1fixed
Opensusepython-dockerleap 15.67.0.0-150400.8.7.1fixed
Susepython-dockerlinux enterprise module for public cloud 15 sp47.0.0-150400.8.7.1fixed
Susepython-dockerlinux enterprise module for public cloud 15 sp57.0.0-150400.8.7.1fixed
Susepython-requestslinux enterprise micro 5.32.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise micro 5.42.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise micro 5.52.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise module for basesystem 15 sp52.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise module for basesystem 15 sp62.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise micro 5.12.25.1-150300.3.9.1fixed
Susepython-requestslinux enterprise micro 5.22.25.1-150300.3.9.1fixed
Opensusepython-requestsleap micro 5.32.25.1-150300.3.9.1fixed
Opensusepython-requestsleap micro 5.42.25.1-150300.3.9.1fixed
Opensusepython-requestsleap 15.52.25.1-150300.3.9.1fixed
Susepython-requestsmanager client tools 122.11.1-6.37.1fixed
Susepython-requestslinux enterprise module for advanced systems management 122.11.1-6.37.1fixed
Susepython-requestsmanager client tools 122.11.1-6.40.1fixed
Susepython-requestslinux enterprise module for advanced systems management 122.11.1-6.40.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrequestssourcesid2.32.3+dfsg-1not yet assignedNot reported[1071593]
Debianrequestssourceforky2.32.3+dfsg-1not yet assignedNot reported[1071593]
Debianrequestssourcetrixie2.32.3+dfsg-1not yet assignedNot reported[1071593]
Debianrequestssourcebookworm(unfixed)not yet assignedNot reported[1071593]
Ubuntupython-pipdebnoble24.0+dfsg-1ubuntu1.3+esm1Not reportedNot reportedNot reported
Ubuntupython3-pipdebnoble24.0+dfsg-1ubuntu1.3+esm1Not reportedNot reportedNot reported
Ubuntupython3-pip-whldebnoble24.0+dfsg-1ubuntu1.3+esm1Not reportedNot reportedNot reported
PyPIrequestsPyPINot reported2.32.0Not reportedGHSA-9WX4-H78V-VM56Not reported
Alpinepy3-requestsapk3.182.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.192.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.202.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.212.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.222.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.232.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Alpinepy3-requestsapk3.242.32.3-r0Not reportedALPINE-CVE-2024-35195Not reported
Ubuntupython-pipdebpro25.1.1+dfsg-1ubuntu2+esm1Not reportedUSN-8344-1Not reported
Susepython-requestsrpmlinux micro 6.02.32.3-1.1Not reportedSUSE-SU-2025:20094-1Not reported
Susepython-requestsrpmlinux micro 6.02.32.2-1.1Not reportedSUSE-SU-2025:20034-1Not reported
Susepython-dockerrpmmanager client tools 152.6.1-150000.4.3.1Not reportedSUSE-SU-2024:2182-1Not reported
Susepython-dockerrpmlinux enterprise module for package hub 15 sp54.2.0-150200.3.5.1Not reportedSUSE-SU-2024:1938-1Not reported
Susepython-dockerrpmlinux enterprise module for package hub 15 sp64.2.0-150200.3.5.1Not reportedSUSE-SU-2024:1938-1Not reported
Opensusepython-dockerrpmleap 15.54.2.0-150200.3.5.1Not reportedSUSE-SU-2024:1938-1Not reported
Opensusepython-dockerrpmleap 15.64.2.0-150200.3.5.1Not reportedSUSE-SU-2024:1938-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 15 sp42.31.0-150400.6.12.1Not reportedSUSE-SU-2024:1857-1Not reported
Susepython-requestsrpmlinux enterprise module for python 3 15 sp52.31.0-150400.6.12.1Not reportedSUSE-SU-2024:1857-1Not reported
Susepython-requestsrpmlinux enterprise module for python 3 15 sp62.31.0-150400.6.12.1Not reportedSUSE-SU-2024:1857-1Not reported
Opensusepython-requestsrpmleap 15.52.31.0-150400.6.12.1Not reportedSUSE-SU-2024:1857-1Not reported
Opensusepython-requestsrpmleap 15.62.31.0-150400.6.12.1Not reportedSUSE-SU-2024:1857-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp3-ltss2.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp4-espos2.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp4-ltss2.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise server 15 sp3-ltss2.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise server 15 sp4-ltss2.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp32.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp42.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmmanager proxy 4.32.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmmanager server 4.32.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmenterprise storage 7.12.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-2Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 15 sp42.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise module for python 3 15 sp52.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise module for python 3 15 sp62.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp4-espos2.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise high performance computing 15 sp4-ltss2.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise server 15 sp4-ltss2.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 15 sp42.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Opensusepython-requestsrpmleap 15.52.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Opensusepython-requestsrpmleap 15.62.31.0-150400.6.15.1Not reportedSUSE-RU-2024:3600-1Not reported
Susepython-requestsrpmlinux enterprise high availability extension 12 sp52.24.0-8.20.1Not reportedSUSE-RU-2024:3598-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 122.24.0-8.20.1Not reportedSUSE-RU-2024:3598-1Not reported
Susepython-requestsrpmlinux enterprise server 12 sp52.24.0-8.20.1Not reportedSUSE-RU-2024:3598-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 12 sp52.24.0-8.20.1Not reportedSUSE-RU-2024:3598-1Not reported
Susepython-requestsrpmlinux enterprise high availability extension 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2024:2068-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 122.24.0-8.17.1Not reportedSUSE-SU-2024:2068-1Not reported
Susepython-requestsrpmlinux enterprise server 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2024:2068-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 12 sp52.24.0-8.17.1Not reportedSUSE-SU-2024:2068-1Not reported
Susepython-dockerrpmlinux enterprise module for public cloud 15 sp67.0.0-150400.8.7.1Not reportedSUSE-SU-2024:1937-2Not reported
Opensusepython-dockerrpmleap 15.57.0.0-150400.8.7.1Not reportedSUSE-SU-2024:1937-2Not reported
Opensusepython-dockerrpmleap 15.67.0.0-150400.8.7.1Not reportedSUSE-SU-2024:1937-2Not reported
Susepython-dockerrpmlinux enterprise module for public cloud 15 sp47.0.0-150400.8.7.1Not reportedSUSE-SU-2024:1937-1Not reported
Susepython-dockerrpmlinux enterprise module for public cloud 15 sp57.0.0-150400.8.7.1Not reportedSUSE-SU-2024:1937-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.32.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.42.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.52.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise module for basesystem 15 sp52.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise module for basesystem 15 sp62.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.12.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmlinux enterprise micro 5.22.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Opensusepython-requestsrpmleap micro 5.32.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Opensusepython-requestsrpmleap micro 5.42.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Opensusepython-requestsrpmleap 15.52.25.1-150300.3.9.1Not reportedSUSE-SU-2024:1880-1Not reported
Susepython-requestsrpmmanager client tools 122.11.1-6.37.1Not reportedSUSE-SU-2024:1946-1Not reported
Susepython-requestsrpmlinux enterprise module for advanced systems management 122.11.1-6.37.1Not reportedSUSE-SU-2024:1946-1Not reported
Susepython-requestsrpmmanager client tools 122.11.1-6.40.1Not reportedSUSE-RU-2024:3599-1Not reported
Susepython-requestsrpmlinux enterprise module for advanced systems management 122.11.1-6.40.1Not reportedSUSE-RU-2024:3599-1Not reported

[Debian bug #1071593]

Notes

[bookworm] requests: Minor issue, too intrusive to backport

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [requests]

    Details (2)
    • 2.28.1+dfsg-1 · all · bookworm

      Affected

      usn · requests · debian · bookworm; usn · requests · debian · 12

    • 2.28.1+dfsg-1 · all · bookworm

      Affected

      usn · requests · debian · bookworm; usn · requests · debian · 12

  • Source package: [requests]

    Details (2)
    • 2.28.1+dfsg-1 · all · bookworm

      Affected

      usn · requests · debian · bookworm; usn · requests · debian · 12

    • 2.28.1+dfsg-1 · all · bookworm

      Affected

      usn · requests · debian · bookworm; usn · requests · debian · 12

[Debian 13 (Trixie)]

  • Source package: [requests]

    Details (2)
    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.32.3+dfsg-1

      usn · requests · debian · 13

    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.32.3+dfsg-1

      usn · requests · debian · 13

  • Source package: [requests]

    Details (2)
    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.32.3+dfsg-1

      usn · requests · debian · 13

    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.32.3+dfsg-1

      usn · requests · debian · 13

Observed:

References