PublicDateAtUSN: 2015-03-16
Candidate: CVE-2015-2296
PublicDate: 2015-03-18 16:59:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2296
 http://www.openwall.com/lists/oss-security/2015/03/14/4
 https://warehouse.python.org/project/requests/2.6.0/
 https://ubuntu.com/security/notices/USN-2531-1
Description:
 The resolve_redirects function in sessions.py in requests 2.1.0 through
 2.5.3 allows remote attackers to conduct session fixation attacks via a
 cookie without a host value in a redirect.
Ubuntu-Description: 
Notes: 
 mdeslaur> reproducer script:
 mdeslaur> https://gist.github.com/OddBloke/211ff98b63a8cfb3f6d4
Bugs: 
 https://bugs.launchpad.net/ubuntu/+source/requests/+bug/1432555
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780506
Priority: medium
Discovered-by: Matthew Daley
Assigned-to: mdeslaur
CVSS: 

Patches_requests:
 upstream: https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
upstream_requests: released (2.6.0,2.4.3-6)
lucid_requests: DNE
precise_requests: not-affected (0.8.2-1)
trusty_requests: released (2.2.1-1ubuntu0.2)
trusty/esm_requests: released (2.2.1-1ubuntu0.2)
utopic_requests: released (2.3.0-1ubuntu0.1)
devel_requests: not-affected (2.4.3-6)