CVE-2018-18074: python-requests package may reveal credentials

[Ken Young]

Title
-----
CVE-2018-18074: requests package may reveal credentials

Brief Description
-----------------
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

This potential issue was identified by spec file requirement scanning in git hub. The email from GitHub is attached.

Red Hat's analysis is here: https://access.redhat.com/security/cve/cve-2018-18074

NIST is here: https://nvd.nist.gov/vuln/detail/CVE-2018-18074
    - no data yet.

Severity
--------
<Minor: System/Feature is usable with minor issue>

[Ken Young (kenyis)]

Red Hat's analysis of this issue shows that it is criticality is low:

CVSS3 Base Score 2.6
CVSS3 Base Metrics CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

[Ken Young (kenyis)]

Reviewed at the security meeting on Nov 19th. The plan is to fix this CVE as part of normal rebasing.

[Ramaswamy Subramanian (rsubrama)]

Stx 8.0 Debian version has 2.25 version. This issue is already fixed.