CVE-2015-2296
CVE-2015-2296
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
EPSS 3.4% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
requests Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.3-6
Update to 2.4.3-6
requests Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.3-6
Update to 2.4.3-6
requests Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.3-6
Update to 2.4.3-6
requests PyPI
- Versions
- 2.1.0
- 2.2.0
- 2.2.1
- 2.3.0
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- Affected ranges
- ECOSYSTEM: ≥ 2.1.0, < 2.6.0
Update to 2.6.0
requests PyPI
- Versions
- 2.1.0
- 2.2.0
- 2.2.1
- 2.3.0
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- v2.5.2
- v2.5.1
- v2.5.0
- v2.4.3
- v2.4.2
- v2.4.1
- v2.4.0
- v2.3.0
- v2.2.1
- v2.2.0
- v2.1.0
- v2.0.1
- v2.0.0
- v2.0
- 2.0
- v1.2.3
- v1.2.2
- v1.2.1
- v1.2.0
- v1.1.0
- v1.0.4
- v1.0.3
- v1.0.2
- v1.0.1
- v1.0.0
- v0.14.2
- v0.14.0
- v0.14.1
- v0.13.9
- v0.13.7
- v0.13.6
- v0.13.5
- v0.13.4
- v0.13.3
- v0.13.2
- v0.13.1
- v0.13.0
- v0.12.1
- v0.12.0
- v0.11.1
- v0.10.8
- v0.10.7
- v0.10.6
- v0.10.5
- v0.10.4
- v0.10.3
- v0.10.2
- v0.10.1
- v0.10.0
- v0.9.3
- v0.9.1
- v0.9.0
- v0.8.9
- v0.8.8
- v0.6.4
- v0.6.3
- v0.5.1
- v0.5.0
- v0.4.1
- v0.4.0
- v0.3.4
- v0.3.3
- v0.3.2
- v0.3.0
- v0.2.4
- v0.2.3
- v0.2.2
- v0.2.1
- v0.2.0
- Affected ranges
- GIT: < 3bd8afbff29e50b38f889b2f688785a669b9aafc
- ECOSYSTEM: ≥ 2.1.0, < 2.6.0
Update to 2.6.0
requests Ubuntu:14.04:LTS
- Versions
- 1.2.3-1
- 2.0.0-1
- 2.2.1-1
- 2.2.1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 2.2.1-1ubuntu0.2
Update to 2.2.1-1ubuntu0.2
Original sources
- http://www.openwall.com/lists/oss-security/2015/03/15/1
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:133
- http://www.openwall.com/lists/oss-security/2015/03/14/4
- http://www.ubuntu.com/usn/USN-2531-1
- https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
- http://advisories.mageia.org/MGASA-2015-0120.html
- https://warehouse.python.org/project/requests/2.6.0/
- https://nvd.nist.gov/vuln/detail/CVE-2015-2296