Exposure of Sensitive Information to an Unauthorized Actor in Requests

MEDIUM 5.0CVE-2014-1829 · GHSA-cfj3-7x9c-4p3h · PYSEC-2014-13 · Published 15/10/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
requests PyPI	`< 2.3.0`	`2.3.0`
requests python	`≤ 2.2.1`	No fix yet

Description

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

NVD description

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

References

nvd.nist.gov/vuln/detail/CVE-2014-1829 · ADVISORY
kennethreitz/requests · WEB
psf/requests · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
GitHub Advisory GHSA-cfj3-7x9c-4p3h · ADVISORY
psf/requests · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133 · WEB
advisories.mageia.org/MGASA-2014-0409.html · WEB
debian.org/security/2015/dsa-3146 · WEB
mandriva.com/security/advisories · WEB
ubuntu.com/usn/USN-2382-1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free