Bug 1202904 (CVE-2015-2296) - CVE-2015-2296 python-requests: session fixation and cookie stealing vulnerability
Summary: CVE-2015-2296 python-requests: session fixation and cookie stealing vulnerabi...
Status: CLOSED ERRATA
Alias: CVE-2015-2296
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150314,repor...
Keywords: Reopened, Security
Depends On: 1202906
Blocks: 1202909
TreeView+ depends on / blocked
 
Reported: 2015-03-17 16:39 UTC by Martin Prpič
Modified: 2019-06-08 20:29 UTC (History)
32 users (show)

(edit)
A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL.
Clone Of:
(edit)
Last Closed: 2016-04-08 19:31:57 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-03-17 16:39:06 UTC
The following flaw was found in python-requests:

The issue occurs when Requests is handling a HTTP response that is a redirection and that also sets cookies without an explicit domain parameter. Instead of the cookies only being set for the domain which sent the HTTP response, they are also sent to the redirection target, regardless of its domain.

The issue could be exploited in the following ways:

* If you are the redirection source (ie. you can make Requests hit your URL), you can make Requests perform a request to any third-party domain with cookies of your choosing. This may be useful in performing a session fixation attack.

* If you are the redirection target (ie. you can make a third-party site redirect to your URL), you are able to steal any cookies set by the third-party redirection.

This issue affects versions 2.1.0 and later, and is fixed in version 2.6.0:

https://warehouse.python.org/project/requests/2.6.0/

Upstream patch:

https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc

Comment 1 Martin Prpič 2015-03-17 16:44:02 UTC
Created python-requests tracking bugs for this issue:

Affects: fedora-21 [bug 1202906]

Comment 2 Fedora Update System 2015-03-29 04:51:29 UTC
python-requests-2.5.3-2.fc21, python-urllib3-1.10.2-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Ralph Bean 2015-09-19 01:12:21 UTC
I think this one can be closed now.  python-requests-2.6.0 is available in all active Fedora releases as well as rhel6-base and rhel7-base.


Note You need to log in before you can comment on or make changes to this bug.