VYPR
Moderate severityNVD Advisory· Published Mar 18, 2015· Updated May 6, 2026

CVE-2015-2296

CVE-2015-2296

Description

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
requestsPyPI
>= 2.1.0, < 2.6.02.6.0

Affected products

14
  • cpe:2.3:a:python:requests:2.1.0:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:python:requests:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:requests:2.5.3:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 1 more
    • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
  • cpe:2.3:o:mageia_project:mageia:4.0:*:*:*:*:*:*:*

Patches

2
3bd8afbff29e

Don't ascribe cookies to the target domain.

https://github.com/kennethreitz/requestsCory BenfieldMar 14, 2015via ghsa
1 file changed · +1 1
  • requests/sessions.py+1 1 modified
    @@ -171,7 +171,7 @@ def resolve_redirects(self, resp, req, stream=False, timeout=None,
                 except KeyError:
                     pass
     
    -            extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw)
    +            extract_cookies_to_jar(prepared_request._cookies, req, resp.raw)
                 prepared_request._cookies.update(self.cookies)
                 prepared_request.prepare_cookies(prepared_request._cookies)
     
    
3bd8afbff29e

Don't ascribe cookies to the target domain.

https://github.com/psf/requestsCory BenfieldMar 14, 2015via ghsa
1 file changed · +1 1
  • requests/sessions.py+1 1 modified
    @@ -171,7 +171,7 @@ def resolve_redirects(self, resp, req, stream=False, timeout=None,
                 except KeyError:
                     pass
     
    -            extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw)
    +            extract_cookies_to_jar(prepared_request._cookies, req, resp.raw)
                 prepared_request._cookies.update(self.cookies)
                 prepared_request.prepare_cookies(prepared_request._cookies)
     
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.