CVE-2015-2296 Python Requests Session Fixation
Remote attackers can hijack user sessions via crafted redirect cookies in the requests library, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-2296?
CVE-2015-2296 is a medium-severity authentication bypass vulnerability in Canonical Ubuntu Linux, published on 18 Mar 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Which versions are affected by CVE-2015-2296?
3 open source packages ship an affected version, including requests. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
requests PyPI | From 2.1.0 | 2.6.0 |
requests PyPI | From 2.1.0 | 2.6.0 |
requests PyPI | From 2.1.0 | 2.6.0 |
Linux distribution packages (11)
python-requests SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Enterprise Storage 1.0 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Enterprise Storage 2 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise High Availability Extension 12 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Server 12 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Server 12 SP1 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 2.8.1-6.9.1 |
python-requests SUSE:OpenStack Cloud 5 | All versions | 2.3.0-9.2 |
Products include Canonical Ubuntu Linux, Mageia Project Mageia, Python Requests.
How do I fix CVE-2015-2296?
Upgrade requests to 2.6.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-2296 being exploited?
There is no known exploitation of CVE-2015-2296 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2015-2296, GHSA-pg2w-x9wp-vw92, MGASA-2015-0120, PYSEC-2015-17, SUSE-SU-2015:2156-1, SUSE-SU-2016:0114-1 and 2 more.