CVE-2014-1829: Vulnerability in requests package
Summary
CVE-2014-1829: Exposure of Sensitive Information to an Unauthorized Actor in Requests. Affects requests versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Also tracked for
- requests · Debian:11
The same CVE-2014-1829 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests package, also known as python-requests, is a popular Python library used for making HTTP requests. It provides a simple and intuitive API for sending HTTP/1.1 requests. The package is widely used in various Python applications and frameworks to interact with web services and APIs. However, versions before 2.3.0 are susceptible to a security vulnerability.
Vulnerability Detail
The vulnerability (CVE-2014-1829) in the requests package allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request. This means that an attacker could potentially intercept the Authorization header and retrieve sensitive information, such as passwords, stored in the netrc file. This vulnerability poses a significant risk to applications that use the requests package for handling HTTP requests.
How To Fix
Latest published version: 2.34.2 as of 22 Oct 2026
pip install --upgrade "requests==2.34.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
pip install --upgrade "requests==2.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the requests package is not immediately feasible, a possible workaround is to avoid using the netrc file for storing sensitive information. Instead, credentials can be securely managed and provided programmatically when making requests using the requests library. Here's an example of how to pass credentials directly in the request:
import requests
url = 'https://example.com/api' username = 'your_username' password = 'your_password'
response = requests.get(url, auth=(username, password))
Conclusion
In conclusion, the requests package before version 2.3.0 is vulnerable to CVE-2014-1829, which allows remote servers to obtain a netrc password. It is crucial to upgrade to the fixed version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote servers to obtain a netrc password, potentially exposing sensitive information stored in the netrc file. This can lead to unauthorized access to accounts and systems.
Versions before 2.3.0 are affected by this vulnerability. It is recommended to upgrade to version 2.3.0 or higher.
Yes, if immediate upgrade is not possible, credentials can be passed directly in the request instead of relying on the netrc file.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will alert you in real-time.
You can find more information about this vulnerability in the advisory database of the Python Packaging Authority (PyPA) at https://github.com/pypa/advisory-database/blob/main/vulns/requests/PYSEC-2014-13.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
