CVE-2014-1830 Exposure of Sensitive Information to an Unauthorized Actor in Requests
A remote server can obtain sensitive proxy credentials from redirected requests in the python-requests library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-1830?
CVE-2014-1830 is a medium-severity vulnerability in Opensuse Opensuse, published on 15 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
Weakness: CWE-200
Which versions are affected by CVE-2014-1830?
3 open source packages ship an affected version, including requests. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
requests PyPI | All versions | 2.3.0 |
requests PyPI | All versions | 2.3.0 |
requests PyPI | All versions | 2.3.0 |
Products include Opensuse Opensuse, Python Requests.
How do I fix CVE-2014-1830?
Upgrade requests to 2.3.0 or later.
Is CVE-2014-1830 being exploited?
There is no known exploitation of CVE-2014-1830 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2014-1830, ECHO-746a-0a98-0b10, GHSA-652x-xj99-gmcc, PYSEC-2014-14, UBUNTU-CVE-2014-1830.