logo

Database

Session Fixation In requests

Description

Python Requests Session Fixation The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2015-22962. NVD-2015-22963. OSV-2015-22964. OSV-DEBIAN-2015-22965. GCVE-2015-22966. SECURITY-TRACKER-CVE-2015-2296

References

1. https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc2. https://github.com/psf/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc3. https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2015-17.yaml4. https://warehouse.python.org/project/requests/2.6.05. http://advisories.mageia.org/MGASA-2015-0120.html6. http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html7. http://www.mandriva.com/security/advisories?name=MDVSA-2015:1338. http://www.openwall.com/lists/oss-security/2015/03/14/49. http://www.openwall.com/lists/oss-security/2015/03/15/110. http://www.ubuntu.com/usn/USN-2531-1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.