id: PYSEC-2014-14
details: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain
  sensitive information by reading the Proxy-Authorization header in a redirected
  request.
affected:
- package:
    name: requests
    ecosystem: PyPI
    purl: pkg:pypi/requests
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.0
  versions:
  - 0.0.1
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.10.3
  - 0.10.4
  - 0.10.6
  - 0.10.7
  - 0.10.8
  - 0.11.1
  - 0.11.2
  - 0.12.0
  - 0.12.01
  - 0.12.1
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.13.3
  - 0.13.4
  - 0.13.5
  - 0.13.6
  - 0.13.7
  - 0.13.8
  - 0.13.9
  - 0.14.0
  - 0.14.1
  - 0.14.2
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - 0.6.5
  - 0.6.6
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.8.8
  - 0.8.9
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.1.0
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.0
  - 2.2.1
references:
- type: REPORT
  url: https://github.com/kennethreitz/requests/issues/1885
- type: WEB
  url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108
- type: ADVISORY
  url: http://www.debian.org/security/2015/dsa-3146
- type: ADVISORY
  url: http://www.mandriva.com/security/advisories?name=MDVSA-2015:133
- type: ADVISORY
  url: http://advisories.mageia.org/MGASA-2014-0409.html
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2016-01/msg00095.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-652x-xj99-gmcc
aliases:
- CVE-2014-1830
- GHSA-652x-xj99-gmcc
modified: "2021-07-05T00:01:25.679942Z"
published: "2014-10-15T14:55:00Z"