5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-35195

CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

When making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool.

Remediation

Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.

Upgrade to requests>=2.32.0.
For requests<2.32.0, avoid setting verify=False for the first request to a host while using a Requests Session.
For requests<2.32.0, call close() on Session objects to clear existing connections if verify=False is used.

CVE-2024-35195:

5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
requests	pip	< 2.32.0	2.32.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability occurs because the requests.Session object, through its HTTPAdapter, could reuse a connection from its pool that was initially established with verify=False, even for subsequent requests to the same host that specified verify=True. The analysis of the patch commit c0813a2d910ea6b4f8438b91d315b8d181302356 shows that the requests.adapters.HTTPAdapter.send method was modified. Specifically, its call to get_connection was changed to a new method _get_connection which now explicitly takes the verify status of the current request into account when obtaining a connection from the urllib3 connection pool. This indicates that the send method, in its previous form, was the point where the decision to get a connection was made without properly ensuring the verify flag was re-evaluated for pooled connections. The requests.adapters.HTTPAdapter.get_connection method (pre-patch) was the function whose logic was insufficient for preventing this incorrect reuse. The patch addresses this by ensuring that the verify status (specifically cert_reqs) is part of the parameters (pool_kwargs) used to fetch a connection from the pool for every request, preventing the reuse of a verify=False connection for a verify=True request.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

Remediation

Related Links

CVE-2024-35195:

5.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

Remediation

Related Links

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

5.6

5.6

5.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

Remediation

Related Links

CVE-2024-35195:

5.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

Remediation

Related Links

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.6

5.6

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI