vdanen/rhvex-cve huggingface dataset:
CVE-2014-7142 (Low severity, published 2014-09-15)
CVSS score: 1.8 (AV:A/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-129
Description: The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
Statement: This issue did not affect the versions of squid as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they do not provide the vulnerable program "pinger".
CVE-2014-7841 (Important severity, published 2014-11-09)
CVSS score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-476
Description: A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.
CVE-2014-9449 (Moderate severity, published 2014-06-04)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-120
Description: Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.
CVE-2014-1583 (Moderate severity, published 2014-10-13)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
CVE-2014-7904 (Important severity, published 2014-11-17)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in Skia, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Statement: This issue did not affect the versions of librsvg2 as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the version of librsvg2 as shipped with Red Hat Enterprise Linux 7.
CVE-2014-0238 (Moderate severity, published 2014-05-28)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-835
Description: A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.
Statement: This issue did not affect the php and the file packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of file as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-0516 (Moderate severity, published 2014-05-12)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVE-2014-8126 (Important severity, published 2015-01-11)
CVSS score: 8.5 (AV:N/AC:L/Au:S/C:C/I:C/A:N)
CWE: CWE-78
Description: The HTCondor scheduler can optionally notify a user of completed jobs by sending an email. Due to the way the daemon sent the email message, authenticated users able to submit jobs could execute arbitrary code with the privileges of the condor user.
CVE-2014-0146 (Low severity, published 2014-03-25)
CVSS score: 4 (AV:L/AC:H/Au:N/C:N/I:N/A:C)
CWE: CWE-476
Description: The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.
CVE-2014-1307 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-6568 (Low severity, published 2015-01-20)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.
CVE-2014-6587 (Low severity, published 2015-01-19)
CVSS score: 4.1 (AV:L/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-476
Description: A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
CVE-2014-9672 (Low severity, published 2014-11-23)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-129
Description: Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.
Statement: Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6 and 7.
CVE-2014-4040 (Low severity, published 2014-06-12)
CVSS score: 1.2 (AV:L/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-200
Description: A flaw was found in the way the snap utility of powerpc-utils generated an archive containing a configuration snapshot of a service. A local attacker could obtain sensitive information from the generated archive such as plain text passwords.
CVE-2014-0453 (Moderate severity, published 2014-04-14)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
CVE-2014-4943 (Important severity, published 2014-07-15)
CVSS score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Description: A flaw was found in the way the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation handled requests with a non-SOL_PPPOL2TP socket option level. A local, unprivileged user could use this flaw to escalate their privileges on the system.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Please note that on Red Hat Enterprise Linux 6 pppol2tp module is not
automatically loaded when AF_PPPOX/PX_PROTO_OL2TP socket is created as
Red Hat Enterprise Linux 6 lacks upstream commit 9395a09d05a23bb and default
modprobe configuration as shipped with module-init-tools package does not
contain the alias for pppol2tp protocol either. As a result, pppol2tp module
has to be explicitly enabled and/or loaded by the system administrator.
Mitigation: For Red Hat Enterprise Linux 6 do --

]# echo "install pppol2tp /bin/true" > /etc/modprobe.d/pppol2tp.conf

For Red Hat Enterprise Linux 7 do --

]# echo "install l2tp_ppp /bin/true" > /etc/modprobe.d/l2t_pppp.conf

Or, alternatively, when pppol2tp/l2tp_ppp module can't be blacklisted and needs
to be loaded, you can use the following systemtap script --

1) On the host, save the following in a file with the ".stp" extension --

probe module("*l2tp*").function("pppol2tp_*etsockopt").call {
        $level = 273;
}

2) Install the "systemtap" package and any required dependencies. Refer to
the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux 6
"SystemTap Beginners Guide" document, available from docs.redhat.com, for
information on installing the required -debuginfo packages.

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.

Alternatively, build the systemtap script on a development system with
"stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel
module to all affected systems, and run "staprun -L <module>" on those.
When using this approach only systemtap-runtime package is required on the
affected systems. Please notice that the kernel version must be the same across
all systems.
CVE-2014-0003 (Important severity, published 2014-02-27)
CVSS score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Description: The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
CVE-2014-3506 (Moderate severity, published 2014-08-05)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400
Description: A flaw was discovered in the way OpenSSL handled DTLS packets. A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory.
CVE-2014-7816 (Important severity, published 2014-10-27)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200
Description: It was discovered that Undertow is vulnerable to a directory traversal flaw. A remote attacker could use this flaw to read arbitrary files that are accessible to the user running the Java process.
Statement: Not vulnerable. This issue does not affect any Red Hat product.
CVE-2014-1491 (Moderate severity, published 2014-02-03)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-358
Description: It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.
CVE-2014-9808 (Moderate severity, published 2014-12-23)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20
Description: ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted dpc image.
CVE-2014-1868 (Moderate severity, published 2014-02-08)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Statement: Not affected. Restlet as shipped with various Red Hat products does not include any of the extensions affected by this flaw.
CVE-2014-9721 (Important severity, published 2014-12-03)
CVSS score: 6.1 (AV:A/AC:L/Au:N/C:C/I:N/A:N)
Description: libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
CVE-2014-1311 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-0150 (Moderate severity, published 2014-04-10)
CVSS score: 4 (AV:A/AC:H/Au:S/C:P/I:P/A:P)
Description: Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
Statement: This issue does not affect the kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue does affect the qemu-kvm package as shipped with Red Hat Enterprise Linux 6. Future qemu-kvm updates in Red Hat Enterprise Linux 6 may address this flaw.
CVE-2014-2497 (Low severity, published 2014-03-12)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: A NULL pointer dereference flaw was found in the gdImageCreateFromXpm() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application using gd via a specially crafted X PixMap (XPM) file.
CVE-2014-5352 (Moderate severity, published 2015-02-02)
CVSS score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-416
Description: A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application.
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2014-8130 (Low severity, published 2014-12-06)
CVSS score: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Description: The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.
Statement: Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw in libtiff.
CVE-2014-0015 (Moderate severity, published 2014-01-28)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
Statement: This issue affects the version of curl as shipped with Red Hat Enterprise Linux 5 and 7. The Red Hat Security Response Team has rated this issue as having Moderate security impact, a future update may address this flaw.
Mitigation: Avoid using HTTP NTLM in your application.  If you must use NTLM authentication, ensure that it is the only requested authentication method (use --ntlm specifically, do not use --anyauth or other authentication methods).
CVE-2014-3639 (Low severity, published 2014-09-15)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400
Description: The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
CVE-2014-9664 (Low severity, published 2014-11-23)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-125
Description: FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.
CVE-2014-6591 (Low severity, published 2015-01-19)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-125
Description: A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory.
CVE-2014-1487 (Moderate severity, published 2014-02-03)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-209
Description: The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
CVE-2014-3510 (Moderate severity, published 2014-08-05)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled.
CVE-2014-7945 (Moderate severity, published 2015-01-20)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-125
Description: OpenJPEG before r2908, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, and t2.c.
CVE-2014-1891 (Moderate severity, published 2014-02-05)
CVSS score: 4.3 (AV:A/AC:H/Au:S/C:N/I:N/A:C)
CWE: CWE-190
Description: Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 as we did not have support for Xen hypervisor.
CVE-2014-8167 (Moderate severity, published 2014-02-02)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-297
Description: It was found that the VDSM SSL certificate validation implementation did not check whether the server host name matched the domain name in a subject's Common Name (CN) field in a X.509 certificate. A man-in-the-middle attacker could use this flaw to spoof a VDSM server using a specially crafted X.509 certificate.
Statement: This issue affects the versions of vdsm as shipped with Red Hat Enterprise Vitalization 3.x. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-0557 (Critical severity, published 2014-09-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
CVE-2014-0107 (Important severity, published 2014-03-23)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-358
Description: It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java.
CVE-2014-3681 (Moderate severity, published 2014-10-01)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1346 (Moderate severity, published 2015-01-25)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-1716 (Moderate severity, published 2014-03-19)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79
Description: Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVE-2014-0412 (Moderate severity, published 2014-01-13)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
CVE-2014-0042 (Low severity, published 2014-01-08)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
CWE: CWE-494
Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
CVE-2014-9849 (Moderate severity, published 2014-12-23)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).
CVE-2014-7154 (Moderate severity, published 2014-09-22)
CVSS score: 4.3 (AV:A/AC:H/Au:S/C:N/I:N/A:C)
CWE: CWE-667
Description: Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.
Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.
CVE-2014-1829 (Low severity, published 2013-12-24)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-201
Description: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Statement: This issue did not affect the versions of python-requests as shipped with Red Hat Enterprise Linux 7 as they included a fix for this issue at GA.

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.