CVE-2018-18074

Advisory

Requesocks (a fork of requests package, working with socks proxy) is vulnerable to CVE-2018-18074.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------

* CVE-2016-9015. Users who are using urllib3 version 1.17 or 1.18 along with
PyOpenSSL injection and OpenSSL 1.1.0 *must* upgrade to this version. This
release fixes a vulnerability whereby urllib3 in the above configuration
would silently fail to validate TLS certificates due to erroneously setting
invalid flags in OpenSSL's ``SSL_CTX_set_verify`` function. These erroneous
flags do not cause a problem in OpenSSL versions before 1.1.0, which
interprets the presence of any flag as requesting certificate validation.

There is no PR for this patch, as it was prepared for simultaneous disclosure
and release. The master branch received the same fix in PR 1010.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
• https://github.com/requests/requests/pull/4718
• https://github.com/requests/requests/issues/4716
• https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff
• https://bugs.debian.org/910766
• https://usn.ubuntu.com/3790-1/
• http://docs.python-requests.org/en/master/community/updates/#release-and-version-history
• https://usn.ubuntu.com/3790-2/
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html
• https://access.redhat.com/errata/RHSA-2019:2035
• https://www.oracle.com/security-alerts/cpujul2022.html