Exposure of Sensitive Information to an Unauthorized Actor in Requests

MEDIUM 5.0CVE-2014-1830 · GHSA-652x-xj99-gmcc · PYSEC-2014-14 · Published 15/10/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
requests PyPI	`< 2.3.0`	`2.3.0`
requests python	`≤ 2.2.1`	No fix yet

Description

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.

NVD description

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.

References

nvd.nist.gov/vuln/detail/CVE-2014-1830 · ADVISORY
kennethreitz/requests · WEB
psf/requests · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
psf/requests · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133 · WEB
advisories.mageia.org/MGASA-2014-0409.html · WEB
lists.opensuse.org/opensuse-updates/2016-01/msg00095.html · WEB
debian.org/security/2015/dsa-3146 · WEB
mandriva.com/security/advisories · WEB
GitHub Advisory GHSA-652x-xj99-gmcc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free