GHSA-pg2w-x9wp-vw92 CVE-2015-2296 PYSEC-2015-17
Python Requests Session Fixation
Medium
PyPI
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 3.18%
- Chance of exploitation in the next 30 days. Higher than 88.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
2.6.0- Upgrade requests to this version or later
Description
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
requests PyPI → 2.6.0
- pip
pip install --upgrade "requests>=2.6.0"- poetry
poetry add "requests>=2.6.0"- uv
uv add "requests>=2.6.0"
References
Advisories
Packages
Other links
- github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
- github.com/psf/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
- github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2015-17.yaml
- warehouse.python.org/project/requests/2.6.0
- advisories.mageia.org/MGASA-2015-0120.html
- lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html
- mandriva.com/security/advisories
- openwall.com/lists/oss-security/2015/03/14/4
- openwall.com/lists/oss-security/2015/03/15/1
- ubuntu.com/usn/USN-2531-1
- warehouse.python.org/project/requests/2.6.0
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function | Medium | Also affects requests |
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs | Medium | Also affects requests |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False | Medium | Also affects requests |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests | Medium | Also affects requests |
| GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests | High | Also affects requests |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor