{"schema_version":"1.9.0","id":"GHSA-pg2w-x9wp-vw92","published":"2022-05-13T01:11:23Z","modified":"2024-12-01T05:57:02.796059Z","aliases":["CVE-2015-2296","PYSEC-2015-17"],"summary":"Python Requests Session Fixation","details":"The `resolve_redirects` function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.","affected":[{"package":{"name":"requests","ecosystem":"PyPI","purl":"pkg:pypi/requests"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.6.0"}]}],"versions":["2.1.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pg2w-x9wp-vw92/GHSA-pg2w-x9wp-vw92.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2296"},{"type":"WEB","url":"https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc"},{"type":"WEB","url":"https://github.com/psf/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2015-17.yaml"},{"type":"WEB","url":"https://warehouse.python.org/project/requests/2.6.0"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2015-0120.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html"},{"type":"WEB","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:133"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/03/14/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/03/15/1"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2531-1"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2023-07-31T23:49:22Z","nvd_published_at":"2015-03-18T16:59:00Z","severity":"MODERATE"}}