PT-2021-18240 · Pypi · Requests

Whyisjake + 1 · Published 2021-04-27 · Updated 2021-05-07 · CVE-2021-29476

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Requests versions 1.6.0 through 1.7.0

Description: The issue concerns the mishandling of deserialization in FilteredIterator. This allows for the unserialization of untrusted data.

Recommendations: For versions 1.6.0, 1.6.1, and 1.7.0, update to version 1.8.0.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-29476

GHSA-52QP-JPQ7-6C54

Affected Products

Requests

References · 21

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/rmccue/requests/CVE-2021-29476.yaml · Exploit
• https://github.com/rmccue/Requests/pull/421 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29476 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29476 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29476 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29476 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-29476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29476 · Security Note
• https://osv.dev/vulnerability/GHSA-52qp-jpq7-6c54 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29476 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3 · Note
• https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54 · Note
• https://github.com/ambionics/phpggc/issues/52 · Note
• https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress · Note
• https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf · Note