CVE-2014-1829
Exposure of Sensitive Information to an Unauthorized Actor in Requests
CVE-2014-1829 is a medium vulnerability (CVSS 5.0) in Python Requests, published September 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in requests 2.3.0.
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Exploit likelihood
What each source reports
NVD Score used
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
CVE-2014-1829- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
CVE-2014-1829- Updated
- 2026-11-02
EUVDEUVD-2014-0097 No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
EUVD-2014-0097- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cfj3-7x9c-4p3h
Exposure of Sensitive Information to an Unauthorized Actor in Requests
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
GHSA-cfj3-7x9c-4p3h- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-cfj3-7x9c-4p3h
Exposure of Sensitive Information to an Unauthorized Actor in Requests
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
GHSA-cfj3-7x9c-4p3h- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
CVE-2014-1829- Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2014-1829 No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
DEBIAN-CVE-2014-1829- Updated
- 2026-11-02
OSVMGASA-2014-0409 No score
Updated python-requests packages fix security vulnerabilities
Updated python-requests packages fix security vulnerability:
Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their passwords stored in the ~/.netrc file (CVE-2014-1829).
It was discovered that the python-requests Proxy-Authorization header was never re-evaluated when a redirect occurs. The Proxy-Authorization header was sent to any new proxy or non-proxy destination as redirected (CVE-2014-1830).
- Record
MGASA-2014-0409- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10125-1 No score
python-requests-2.11.1-1.1 on GA media
These are all security issues fixed in the python-requests-2.11.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10125-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10482-1 No score
python3-requests-2.11.1-1.2 on GA media
These are all security issues fixed in the python3-requests-2.11.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10482-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11266-1 No score
python36-requests-2.25.1-4.2 on GA media
These are all security issues fixed in the python36-requests-2.25.1-4.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11266-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13999-1 No score
python310-requests-2.32.2-1.1 on GA media
These are all security issues fixed in the python310-requests-2.32.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13999-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12038-1 No score
python313-requests-2.34.2-1.2 on GA media
These are all security issues fixed in the python313-requests-2.34.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12038-1- Updated
- 2026-11-02
OSVPYSEC-2014-13 No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
PYSEC-2014-13- Updated
- 2026-11-02
OSVSUSE-FU-2022:0444-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Track already fixed issues.
- Record
SUSE-FU-2022:0444-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1829 No score
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- Record
UBUNTU-CVE-2014-1829- Updated
- 2026-11-02
OSVUSN-2382-1 No score
requests vulnerabilities
Jakub Wilk discovered that Requests incorrectly reused authentication credentials after being redirected. An attacker could possibly use this issue to obtain authentication credentials intended for another site. (CVE-2014-1829, CVE-2014-1830)
- Record
USN-2382-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
requestsPyPI |
before 2.3.0 | 2.3.0 |
requestsDebian:12 |
before 2.3.0-1 | 2.3.0-1 |
requestsDebian:13 |
before 2.3.0-1 | 2.3.0-1 |
requestsDebian:14 |
before 2.3.0-1 | 2.3.0-1 |
requestsDebian:7 |
before 0.12.1-1+deb7u1, plus listed versions 0.12.1-1 |
0.12.1-1+deb7u1 |
requestsPyPI |
before 2.3.0, plus listed versions 0.0.10.10.00.10.10.10.20.10.3 Show 45 moreShow less0.10.40.10.60.10.70.10.80.11.10.11.20.12.00.12.010.12.10.13.00.13.10.13.20.13.30.13.40.13.50.13.60.13.70.13.80.13.90.14.00.14.10.14.20.2.00.2.10.2.20.2.30.2.40.3.00.3.10.3.20.3.30.3.40.4.00.4.10.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.7.00.7.1 |
2.3.0 |
python-requestsMageia:4 |
before 2.3.0-1.mga4 | 2.3.0-1.mga4 |
requestsUbuntu:14.04:LTS |
before 2.2.1-1ubuntu0.1, plus listed versions 1.2.3-12.0.0-12.2.1-1 |
2.2.1-1ubuntu0.1 |
python-requestsopenSUSE:Tumbleweed |
before 2.11.1-1.1 | 2.11.1-1.1 |
python3-requestsopenSUSE:Tumbleweed |
before 2.11.1-1.2 | 2.11.1-1.2 |
python-requestsopenSUSE:Tumbleweed |
before 2.34.2-1.2 | 2.34.2-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108
mandriva.com/security/advisories?name=MDVSA-2015:133
ubuntu.com/usn/USN-2382-1
github.com/kennethreitz/requests/issues/1885
debian.org/security/2015/dsa-3146
advisories.mageia.org/MGASA-2014-0409.html
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-1829
web.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133?name=MDVSA-2015:133
security-tracker.debian.org/tracker/CVE-2014-1829
bugs.mageia.org/show_bug.cgi?id=14130
bugzilla.redhat.com/show_bug.cgi?id=1046626
suse.com/support/update/announcement/-2022-444/suse-fu-20220444-1
bugzilla.suse.com/1000080
ubuntu.com/security/CVE-2014-1829
openwall.com/lists/oss-security/2014/09/19
cve.org/CVERecord?id=CVE-2014-1829
Left out here: 34 versions and 491 references. The JSON record has them.