Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

requests-2.32.4-py3-none-any.whl: 1 vulnerabilities (highest severity is: 4.4)

Abierto
  • ¿Algo no está bien?
#64 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
58/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
python
Área
cli, security

Línea de trabajo

Comienza localizando la declaración de dependencia en el repositorio sql-cli al que hace referencia la ruta de análisis y confirma dónde está fijada requests 2.32.4. Revisa los detalles de CVE-2026-25645 y actualiza la dependencia directa a la versión corregida 2.33.0; después, ejecuta las pruebas disponibles del proyecto o un análisis de dependencias para verificar que la versión vulnerable ya no está presente.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Mend: dependency security vulnerability
Vulnerable Library - requests-2.32.4-py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/sql-cli

Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/requests-2.32.4.dist-info

Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (requests version) Remediation Possible**
CVE-2026-25645 Medium 4.4 requests-2.32.4-py3-none-any.whl Direct https://github.com/psf/requests.git - v2.33.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-25645
Vulnerable Library - requests-2.32.4-py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl

Path to dependency file: /tmp/ws-scm/sql-cli

Path to vulnerable library: /tmp/ws-ua_20260518195424_ZCYUWM/python_XKNQIE/202605181954251/env/lib/python3.12/site-packages/requests-2.32.4.dist-info

Dependency Hierarchy:

  • ❌ requests-2.32.4-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 68212e0c681da02608aa39ca6a7234d5a082124e

Found in base branch: main

Vulnerability Details

Requests is a HTTP library. Prior to version 2.33.0, the "requests.utils.extract_zipped_paths()" utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call "extract_zipped_paths()" directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set "TMPDIR" in their environment to a directory with restricted write access.

Publish Date: 2026-03-25

URL: CVE-2026-25645

CVSS 3 Score Details (4.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/psf/requests.git - v2.33.0

⛑️ Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

Lenguaje dominante
Python
Estrellas
9
Forks
24
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de opensearch-project/sql-cli

Todos los issues de opensearch-project/sql-cli

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.