Vulnerability advisory

GHSA-cfj3-7x9c-4p3h

Exposure of Sensitive Information to an Unauthorized Actor in Requests

Published May 17, 2022Updated Oct 26, 2024OSV record ↗

Also known as CVE-2014-1829PYSEC-2014-13

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

requests PyPI

All requests advisories →

Affected Fixed in

All versions before 2.3.0 2.3.0Advisories →

Affected	Fixed in
All versions before 2.3.0	`2.3.0`Advisories →
Also listed as affected (84) `0.0.1` `0.10.0` `0.10.1` `0.10.2` `0.10.3` `0.10.4` `0.10.6` `0.10.7` `0.10.8` `0.11.1` `0.11.2` `0.12.0` `0.12.01` `0.12.1` `0.13.0` `0.13.1` `0.13.2` `0.13.3` `0.13.4` `0.13.5` `0.13.6` `0.13.7` `0.13.8` `0.13.9` `0.14.0` `0.14.1` `0.14.2` `0.2.0` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.3.0` `0.3.1` `0.3.2` `0.3.3` `0.3.4` `0.4.0` `0.4.1` `0.5.0` `0.5.1` `0.6.0` `0.6.1` `0.6.2` `0.6.3` `0.6.4` `0.6.5` `0.6.6` `0.7.0` `0.7.1` `0.7.2` `0.7.3` `0.7.4` `0.7.5` `0.7.6` `0.8.0` `0.8.1` `0.8.2` `0.8.3` `0.8.4` `0.8.5` `0.8.6` `0.8.7` `0.8.8` `0.8.9` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `2.0.0` `2.0.1` `2.1.0` `2.2.0` `2.2.1`

Also listed as affected (84)

Description

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2014-1829 ↗
Webgithub.com/kennethreitz/requests/issues/1885 ↗
Webgithub.com/psf/requests/issues/1885 ↗
Webbugs.debian.org/cgi-bin/bugreport.cgi?bug=733108 ↗
Advisorygithub.com/advisories/GHSA-cfj3-7x9c-4p3h ↗
Packagegithub.com/psf/requests ↗
Webgithub.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2014-13.yaml ↗
Webweb.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133/?name=MDVSA-2015:133 ↗
Webadvisories.mageia.org/MGASA-2014-0409.html ↗
Webwww.debian.org/security/2015/dsa-3146 ↗
Webwww.mandriva.com/security/advisories?name=MDVSA-2015:133 ↗
Webwww.ubuntu.com/usn/USN-2382-1 ↗