id: PYSEC-2015-17
details: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3
  allows remote attackers to conduct session fixation attacks via a cookie without
  a host value in a redirect.
affected:
- package:
    name: requests
    ecosystem: PyPI
    purl: pkg:pypi/requests
  ranges:
  - type: GIT
    repo: https://github.com/kennethreitz/requests
    events:
    - introduced: "0"
    - fixed: 3bd8afbff29e50b38f889b2f688785a669b9aafc
  - type: ECOSYSTEM
    events:
    - introduced: 2.1.0
    - fixed: 2.6.0
  versions:
  - 2.1.0
  - 2.2.0
  - 2.2.1
  - 2.3.0
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2015/03/15/1
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-2531-1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2015/03/14/4
- type: FIX
  url: 
    https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
- type: WEB
  url: https://warehouse.python.org/project/requests/2.6.0/
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html
- type: ADVISORY
  url: http://advisories.mageia.org/MGASA-2015-0120.html
- type: ADVISORY
  url: http://www.mandriva.com/security/advisories?name=MDVSA-2015:133
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pg2w-x9wp-vw92
aliases:
- CVE-2015-2296
- GHSA-pg2w-x9wp-vw92
modified: "2021-07-05T00:01:25.716066Z"
published: "2015-03-18T16:59:00Z"