CVE-2015-2296

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing (CVE-2015-2296).

These are all security issues fixed in the python-pip-8.1.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-requests-2.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-requests-2.25.1-4.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python2-pip-20.0.2-2.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-requests-2.32.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-requests-2.34.2-1.2 package on the GA media of openSUSE Tumbleweed.

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

This update for python39-pip, python39-setuptools fixes the following issues:

Changes in python39-setuptools:

• Provide python39-setuptools version 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)

Changes in python39-pip:

• Provide python39-pip version 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:

python-pip was updated to 10.0.1 (fate#324191, bsc#1065275)

Enable python3 build for:

• python-jmespath
• python-jsonschema
• python-paramiko
• python-pexpect
• python-pip
• python-ply
• python-pretend
• python-process-tests
• python-pycodestyle
• python-pyflakes
• python-pyxdg
• python-tabulate
• python-vcversioner

python-requests was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-2296: The resolve_redirects function in sessions.py allowed remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. (bsc#922448)

This non-security issue was fixed:

• Don't use the hardcoded path for certificates. (bsc#935252)

The python-requests module has been updated to version 2.8.1, which brings several fixes and enhancements:

• Fix handling of cookies on redirect. Previously a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing. (bsc#922448, CVE-2015-2296)

• Add support for per-host proxies. This allows the proxies dictionary to have entries of the form {'<scheme>://<hostname>': '<proxy>'}. Host-specific proxies will be used in preference to the previously-supported scheme-specific ones, but the previous syntax will continue to work.

• Update certificate bundle to match 'certifi' 2015.9.6.2's weak certificate bundle.

• Response.raise_for_status now prints the URL that failed as part of the exception message.

• requests.utils.get_netrc_auth now takes an raise_errors kwarg, defaulting to False. When True, errors parsing .netrc files cause exceptions to be thrown.

• Change to bundled projects import logic to make it easier to unbundle requests downstream.

• Change the default User-Agent string to avoid leaking data on Linux: now contains only the requests version.

• The json parameter to post() and friends will now only be used if neither data nor files are present, consistent with the documentation.

• Empty fields in the NO_PROXY environment variable are now ignored.

• Fix problem where httplib.BadStatusLine would get raised if combining stream=True with contextlib.closing.

• Prevent bugs where we would attempt to return the same connection back to the connection pool twice when sending a Chunked body.

• Digest Auth support is now thread safe.

• Resolved several bugs involving chunked transfer encoding and response framing.

• Copy a PreparedRequest's CookieJar more reliably.

• Support bytearrays when passed as parameters in the 'files' argument.

• Avoid data duplication when creating a request with 'str', 'bytes', or 'bytearray' input to the 'files' argument.

• 'Connection: keep-alive' header is now sent automatically.

• Support for connect timeouts. Timeout now accepts a tuple (connect, read) which is used to set individual connect and read timeouts.

For a comprehensive list of changes please refer to the package's change log or the Release Notes at http://docs.python-requests.org/en/latest/community/updates/#id3

This update for python3-requests provides the following fix:

python-requests was updated to 2.20.1.

Update to version 2.20.1:

• Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443).

Update to version 2.20.0:

• Bugfixes

  • Content-Type header parsing is now case-insensitive (e.g. charset=utf8 v Charset=utf8).
  • Fixed exception leak where certain redirect urls would raise uncaught urllib3 exceptions.
  • Requests removes Authorization header from requests redirected from https to http on the same hostname. (CVE-2018-18074)
  • should_bypass_proxies now handles URIs without hostnames (e.g. files).

Update to version 2.19.1:

• Fixed issue where status_codes.py’s init function failed trying to append to a doc value of None.

Update to version 2.19.0:

• Improvements

  • Warn about possible slowdown with cryptography version < 1.3.4
  • Check host in proxy URL, before forwarding request to adapter.
  • Maintain fragments properly across redirects. (RFC7231 7.1.2)
  • Removed use of cgi module to expedite library load time.
  • Added support for SHA-256 and SHA-512 digest auth algorithms.
  • Minor performance improvement to Request.content.

• Bugfixes

  • Parsing empty Link headers with parse_header_links() no longer return one bogus entry.
  • Fixed issue where loading the default certificate bundle from a zip archive would raise an IOError.
  • Fixed issue with unexpected ImportError on windows system which do not support winreg module.
  • DNS resolution in proxy bypass no longer includes the username and password in the request. This also fixes the issue of DNS queries failing on macOS.
  • Properly normalize adapter prefixes for url comparison.
  • Passing None as a file pointer to the files param no longer raises an exception.
  • Calling copy on a RequestsCookieJar will now preserve the cookie policy correctly.

Update to version 2.18.4:

• Improvements

  • Error messages for invalid headers now include the header name for easier debugging

Update to version 2.18.3:

• Improvements
  • Running $ python -m requests.help now includes the installed version of idna.
• Bugfixes
  • Fixed issue where Requests would raise ConnectionError instead of SSLError when encountering SSL problems when using urllib3 v1.22.

• Add ca-certificates (and ca-certificates-mozilla) to dependencies, otherwise https connections will fail.

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Matthew Daley discovered that Requests incorrectly handled cookies without host values when being redirected. A remote attacker could possibly use this issue to perform session fixation or cookie stealing attacks.