[{"CVE":"CVE-2018-18074","severity":"low","public_date":"2018-06-29T00:00:00Z","advisories":["RHSA-2019:2035","RHSA-2020:0850","RHSA-2020:2068","RHBA-2020:1539","RHSA-2020:1916","RHSA-2020:1605","RHSA-2020:0851","RHSA-2020:2081","RHBA-2020:1540"],"bugzilla":"1643829","bugzilla_description":"CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-522","affected_packages":["ansible-tower-35/ansible-tower:3.5.6-1","ansible-tower-36/ansible-tower:3.6.4-1","python-requests-0:2.6.0-5.el7","python-pip-0:9.0.3-7.el7_7","python-virtualenv-0:15.1.0-4.el7_8","python-pip-0:9.0.3-7.el7_8","python-virtualenv-0:15.1.0-4.el7_7","python27:2.7-8020020200117110429.90f98d4f","python-pip-0:9.0.3-16.el8"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18074.json","cvss3_scoring_vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss3_score":"2.6"},{"CVE":"CVE-2018-20060","severity":"moderate","public_date":"2018-03-26T00:00:00Z","advisories":["RHSA-2020:0850","RHSA-2020:2068","RHBA-2020:1539","RHSA-2020:1916","RHSA-2020:1605","RHSA-2020:0851","RHSA-2020:2081","RHSA-2019:2272","RHBA-2020:1540"],"bugzilla":"1649153","bugzilla_description":"CVE-2018-20060 python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-522","affected_packages":["ansible-tower-35/ansible-tower:3.5.6-1","ansible-tower-36/ansible-tower:3.6.4-1","python-urllib3-0:1.10.2-7.el7","python-pip-0:9.0.3-7.el7_7","python-virtualenv-0:15.1.0-4.el7_8","python-pip-0:9.0.3-7.el7_8","python-virtualenv-0:15.1.0-4.el7_7","python27:2.7-8020020200117110429.90f98d4f","python-pip-0:9.0.3-16.el8"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-20060.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss3_score":"5.3"},{"CVE":"CVE-2015-2296","severity":"moderate","public_date":"2015-03-14T00:00:00Z","advisories":[],"bugzilla":"1202904","bugzilla_description":"CVE-2015-2296 python-requests: session fixation and cookie stealing vulnerability","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","CWE":"CWE-201","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-2296.json"},{"CVE":"CVE-2014-1829","severity":"low","public_date":"2013-12-25T00:00:00Z","advisories":[],"bugzilla":"1046626","bugzilla_description":"CVE-2014-1829 python-requests: redirect can expose netrc password","cvss_score":2.6,"cvss_scoring_vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","CWE":"CWE-285->CWE-201","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1829.json"},{"CVE":"CVE-2014-1830","severity":"low","public_date":"2013-12-25T00:00:00Z","advisories":[],"bugzilla":"1144907","bugzilla_description":"CVE-2014-1830 python-requests: Proxy-Authorization header leak","cvss_score":2.6,"cvss_scoring_vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","CWE":null,"affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1830.json"},{"CVE":"CVE-2013-7440","severity":"low","public_date":"2013-08-12T00:00:00Z","advisories":["RHSA-2016:1166","RHEA-2014:1175"],"bugzilla":"1224999","bugzilla_description":"CVE-2013-7440 python: wildcard matching rules do not follow RFC 6125","cvss_score":4.0,"cvss_scoring_vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","CWE":null,"affected_packages":["python27-python-pip-0:7.1.0-2.el7","python27-python-pip-0:7.1.0-2.el6","python27-python-virtualenv-0:13.1.0-1.el7","python-pymongo-0:2.5.2-3.el6sat","python27-python-0:2.7.8-14.el7","python27-python-0:2.7.8-16.el6","python27-python-virtualenv-0:13.1.0-1.el6","python27-python-pymongo-0:3.2.1-1.el7","python27-python-pymongo-0:3.2.1-1.el6","python-requests-0:2.2.1-1.el7sat"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-7440.json"},{"CVE":"CVE-2013-2099","severity":"low","public_date":"2013-05-15T00:00:00Z","advisories":["RHSA-2016:1166","RHBA-2016:1500","RHSA-2014:1690","RHSA-2015:0042","RHSA-2014:1263"],"bugzilla":"963260","bugzilla_description":"CVE-2013-2099 python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns","cvss_score":2.6,"cvss_scoring_vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","CWE":"CWE-407","affected_packages":["python27-python-pymongo-0:3.2.1-1.el7","python27-python-pymongo-0:3.2.1-1.el6","python-backports-ssl_match_hostname-0:3.4.0.2-1.el6","python-pymongo-0:3.2-1.el7sat","python-pymongo-0:3.2-1.el6sat"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2099.json"}]