VIR Vulnerability Intelligence Relay

CVE-2015-2296

medium
Published 2015-03-18 · Modified 2023-11-08
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
6.8

Description

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
ubuntu Ubuntu Affected 2 releases
VersionStatusFixed in
14.10 Affected —
14.04 Affected —
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 2.4.3-6
sid Fixed 2.4.3-6
forky Fixed 2.4.3-6
bullseye Fixed 2.4.3-6
bookworm Fixed 2.4.3-6

Package impact
EcosystemPackageVulnerableFixed
python PyPIrequests>=2.1.0,<2.6.02.6.0
python PyPIrequests<3bd8afbff29e50b38f889b2f688785a669b9aafc||>=2.1.0,<2.6.03bd8afbff29e50b38f889b2f688785a669b9aafc

Application impact
VendorProductVersionsFixed
python pythonrequests2.1.0
python pythonrequests2.2.1
python pythonrequests2.3.0
python pythonrequests2.4.0
python pythonrequests2.4.1
python pythonrequests2.4.2
python pythonrequests2.4.3
python pythonrequests2.5.0
python pythonrequests2.5.1
python pythonrequests2.5.2
python pythonrequests2.5.3

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.