Remote Password Exposure in Requests Package - CVE-2014-1829
Summary
CVE-2014-1829: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request. Affects requests versions < 2.3.0-1. Fixed in 2.3.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Requests package is a widely used HTTP library for Python, designed to simplify making HTTP requests. It abstracts the complexities of making requests and handling responses, providing a user-friendly interface. However, prior to version 2.3.0, Requests had a vulnerability that allowed remote servers to access sensitive netrc passwords through the Authorization header during redirected requests.
Vulnerability Detail
CVE-2014-1829 is a security flaw in the Requests library that allows remote servers to read the Authorization header in redirected requests. This can lead to unauthorized access to sensitive information, particularly netrc passwords, which are used for automatic authentication. The vulnerability arises from improper handling of the Authorization header during HTTP redirection, exposing user credentials to potential attackers.
How To Fix
Minimum fixed version
2.3.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a temporary workaround by avoiding the use of netrc files for authentication or by manually managing the Authorization header to prevent it from being sent during redirects.
Conclusion
CVE-2014-1829 is a critical vulnerability in the Requests package that can expose sensitive netrc passwords through improper handling of the Authorization header. Users are strongly advised to upgrade to version 2.3.0 or later to protect against this security risk. For those unable to upgrade immediately, implementing workarounds can help mitigate the issue temporarily.
See every vulnerability recorded for requests →
FAQ
CVE-2014-1829 is a vulnerability in the Requests library that allows remote servers to access netrc passwords through the Authorization header during redirected requests.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is the exposure of sensitive authentication credentials, which can lead to unauthorized access to user accounts and data.
Yes, upgrading to Requests version 2.3.0 or later mitigates this vulnerability.
As a temporary measure, avoid using netrc files for authentication or manage the Authorization header manually to prevent it from being sent during redirects.
Related vulnerabilities
Recent vulnerabilities recorded for requests.
