CVE-2014-1829 Exposure of Sensitive Information to an Unauthorized Actor in Requests
MediumCVSS 5.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi requests(PyPI) | < 2.3.0 | 2.3.0 |
| pypi requests(PyPI) | = 0.0.1 | No fix listed |
| pypi requests(PyPI) | = 0.10.0 | No fix listed |
| pypi requests(PyPI) | = 0.10.1 | No fix listed |
| pypi requests(PyPI) | = 0.10.2 | No fix listed |
| pypi requests(PyPI) | = 0.10.3 | No fix listed |
| pypi requests(PyPI) | = 0.10.4 | No fix listed |
| pypi requests(PyPI) | = 0.10.6 | No fix listed |
| pypi requests(PyPI) | = 0.10.7 | No fix listed |
| pypi requests(PyPI) | = 0.10.8 | No fix listed |
| pypi requests(PyPI) | = 0.11.1 | No fix listed |
| pypi requests(PyPI) | = 0.11.2 | No fix listed |
| pypi requests(PyPI) | = 0.12.0 | No fix listed |
| pypi requests(PyPI) | = 0.12.01 | No fix listed |
| pypi requests(PyPI) | = 0.12.1 | No fix listed |
| pypi requests(PyPI) | = 0.13.0 | No fix listed |
| pypi requests(PyPI) | = 0.13.1 | No fix listed |
| pypi requests(PyPI) | = 0.13.2 | No fix listed |
| pypi requests(PyPI) | = 0.13.3 | No fix listed |
| pypi requests(PyPI) | = 0.13.4 | No fix listed |
| pypi requests(PyPI) | = 0.13.5 | No fix listed |
| pypi requests(PyPI) | = 0.13.6 | No fix listed |
| pypi requests(PyPI) | = 0.13.7 | No fix listed |
| pypi requests(PyPI) | = 0.13.8 | No fix listed |
| pypi requests(PyPI) | = 0.13.9 | No fix listed |
Show 67 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi requests(PyPI) | = 0.14.0 | No fix listed |
| pypi requests(PyPI) | = 0.14.1 | No fix listed |
| pypi requests(PyPI) | = 0.14.2 | No fix listed |
| pypi requests(PyPI) | = 0.2.0 | No fix listed |
| pypi requests(PyPI) | = 0.2.1 | No fix listed |
| pypi requests(PyPI) | = 0.2.2 | No fix listed |
| pypi requests(PyPI) | = 0.2.3 | No fix listed |
| pypi requests(PyPI) | = 0.2.4 | No fix listed |
| pypi requests(PyPI) | = 0.3.0 | No fix listed |
| pypi requests(PyPI) | = 0.3.1 | No fix listed |
| pypi requests(PyPI) | = 0.3.2 | No fix listed |
| pypi requests(PyPI) | = 0.3.3 | No fix listed |
| pypi requests(PyPI) | = 0.3.4 | No fix listed |
| pypi requests(PyPI) | = 0.4.0 | No fix listed |
| pypi requests(PyPI) | = 0.4.1 | No fix listed |
| pypi requests(PyPI) | = 0.5.0 | No fix listed |
| pypi requests(PyPI) | = 0.5.1 | No fix listed |
| pypi requests(PyPI) | = 0.6.0 | No fix listed |
| pypi requests(PyPI) | = 0.6.1 | No fix listed |
| pypi requests(PyPI) | = 0.6.2 | No fix listed |
| pypi requests(PyPI) | = 0.6.3 | No fix listed |
| pypi requests(PyPI) | = 0.6.4 | No fix listed |
| pypi requests(PyPI) | = 0.6.5 | No fix listed |
| pypi requests(PyPI) | = 0.6.6 | No fix listed |
| pypi requests(PyPI) | = 0.7.0 | No fix listed |
| pypi requests(PyPI) | = 0.7.1 | No fix listed |
| pypi requests(PyPI) | = 0.7.2 | No fix listed |
| pypi requests(PyPI) | = 0.7.3 | No fix listed |
| pypi requests(PyPI) | = 0.7.4 | No fix listed |
| pypi requests(PyPI) | = 0.7.5 | No fix listed |
| pypi requests(PyPI) | = 0.7.6 | No fix listed |
| pypi requests(PyPI) | = 0.8.0 | No fix listed |
| pypi requests(PyPI) | = 0.8.1 | No fix listed |
| pypi requests(PyPI) | = 0.8.2 | No fix listed |
| pypi requests(PyPI) | = 0.8.3 | No fix listed |
| pypi requests(PyPI) | = 0.8.4 | No fix listed |
| pypi requests(PyPI) | = 0.8.5 | No fix listed |
| pypi requests(PyPI) | = 0.8.6 | No fix listed |
| pypi requests(PyPI) | = 0.8.7 | No fix listed |
| pypi requests(PyPI) | = 0.8.8 | No fix listed |
| pypi requests(PyPI) | = 0.8.9 | No fix listed |
| pypi requests(PyPI) | = 0.9.0 | No fix listed |
| pypi requests(PyPI) | = 0.9.1 | No fix listed |
| pypi requests(PyPI) | = 0.9.2 | No fix listed |
| pypi requests(PyPI) | = 0.9.3 | No fix listed |
| pypi requests(PyPI) | = 1.0.0 | No fix listed |
| pypi requests(PyPI) | = 1.0.1 | No fix listed |
| pypi requests(PyPI) | = 1.0.2 | No fix listed |
| pypi requests(PyPI) | = 1.0.3 | No fix listed |
| pypi requests(PyPI) | = 1.0.4 | No fix listed |
| pypi requests(PyPI) | = 1.1.0 | No fix listed |
| pypi requests(PyPI) | = 1.2.0 | No fix listed |
| pypi requests(PyPI) | = 1.2.1 | No fix listed |
| pypi requests(PyPI) | = 1.2.2 | No fix listed |
| pypi requests(PyPI) | = 1.2.3 | No fix listed |
| pypi requests(PyPI) | = 2.0.0 | No fix listed |
| pypi requests(PyPI) | = 2.0.1 | No fix listed |
| pypi requests(PyPI) | = 2.1.0 | No fix listed |
| pypi requests(PyPI) | = 2.2.0 | No fix listed |
| pypi requests(PyPI) | = 2.2.1 | No fix listed |
| debian/requests(Debian:12) | < 2.3.0-1 | 2.3.0-1 |
| debian/requests(Debian:13) | < 2.3.0-1 | 2.3.0-1 |
| debian/requests(Debian:14) | < 2.3.0-1 | 2.3.0-1 |
| debian linux | = 7.0 | No fix listed |
| python requests | <= 2.2.1 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| mageia | = 4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch
- github.com
- bugs.debian.org issue-tracking
- github.com vendor-advisory
- github.com product
- github.com
- web.archive.org
- advisories.mageia.org third-party-advisory vendor-advisory
- DSA-3146 third-party-advisory vendor-advisory
- MDVSA-2015:133 broken-link vendor-advisory
- USN-2382-1 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2014-1829 vendor-advisory
- bugs.debian.org issue-tracking