Python Requests Session Fixation

MEDIUM 6.8CVE-2015-2296 · GHSA-pg2w-x9wp-vw92 · PYSEC-2015-17 · Published 18/03/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
requests PyPI	`≥ 2.1.0, < 2.6.0`	`2.6.0`
requests python	`= 2.1.0= 2.2.1= 2.3.0= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.5.0= 2.5.1= 2.5.2= 2.5.3`	No fix yet

Description

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

NVD description

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

References

nvd.nist.gov/vuln/detail/CVE-2015-2296 · ADVISORY
kennethreitz/requests commit 3bd8afb · WEB
psf/requests commit 3bd8afb · WEB
psf/requests · PACKAGE
pypa/advisory-database · WEB
warehouse.python.org/project/requests/2.6.0 · WEB
advisories.mageia.org/MGASA-2015-0120.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html · WEB
mandriva.com/security/advisories · WEB
openwall.com/lists/oss-security/2015/03/14/4 · WEB
openwall.com/lists/oss-security/2015/03/15/1 · WEB
ubuntu.com/usn/USN-2531-1 · WEB
warehouse.python.org/project/requests/2.6.0 · Vendor Advisory
GitHub Advisory GHSA-pg2w-x9wp-vw92 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free