CVE record
CVE-2015-2296
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
unknown
No parseable CVSS vector returned
Affected packages
1
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| requests | pypi | 2.6.0, 3bd8afbff29e50b38f889b2f688785a669b9aafc |