Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading
    the Authorization header in a redirected request. (CVE-2014-1829)

Updated python-requests packages fix security vulnerabilities :

Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their passwords stored in the ~/.netrc file (CVE-2014-1829).

It was discovered that the python-requests Proxy-Authorization header was never re-evaluated when a redirect occurs. The Proxy-Authorization header was sent to any new proxy or non-proxy destination as redirected (CVE-2014-1830).

In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing (CVE-2015-2296).

Jakub Wilk discovered that in requests, an HTTP library for the Python language, authentication information was improperly handled when a redirect occured. This would allow remote servers to obtain two different types of sensitive information: proxy passwords from the Proxy-Authorization header (CVE-2014-1830 ), or netrc passwords from the Authorization header (CVE-2014-1829 ).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2382-1 advisory.

    Jakub Wilk discovered that Requests incorrectly reused authentication credentials after being redirected.
    An attacker could possibly use this issue to obtain authentication credentials intended for another site.
    (CVE-2014-1829, CVE-2014-1830)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413862	SCA: security update for requests (GHSA-cfj3-7x9c-4p3h)	Tenable Cloud Security	SCA Checks	medium
413862	SCA: security update for requests (GHSA-cfj3-7x9c-4p3h)	Tenable Self-Hosted Container Security	SCA Checks	medium
82386	Mandriva Linux Security Advisory : python-requests (MDVSA-2015:133)	Nessus	Mandriva Local Security Checks	medium
81110	Debian DSA-3146-1 : requests - security update	Nessus	Debian Local Security Checks	medium
78467	Ubuntu 14.04 LTS : Requests vulnerabilities (USN-2382-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-1829

medium

Tenable Plugins

medium

medium

medium

medium

medium