The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

The remote NewStart CGSL host, running version MAIN 6.02, has python-requests packages installed that are affected by a vulnerability:

  - A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A     remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL. (CVE-2015-2296)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL.

Updated python-requests packages fix security vulnerabilities :

Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their passwords stored in the ~/.netrc file (CVE-2014-1829).

It was discovered that the python-requests Proxy-Authorization header was never re-evaluated when a redirect occurs. The Proxy-Authorization header was sent to any new proxy or non-proxy destination as redirected (CVE-2014-1830).

In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing (CVE-2015-2296).

Backport of patch to not ascribe cookies to the target domain.

  -     https://github.com/kennethreitz/requests/commit/3bd8afbf     f29e50b38f889b2f688785a669b9aafc

  - http://www.openwall.com/lists/oss-security/2015/03/14/4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2531-1 advisory.

    Matthew Daley discovered that Requests incorrectly handled cookies without host values when being     redirected. A remote attacker could possibly use this issue to perform session fixation or cookie stealing     attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206827	NewStart CGSL MAIN 6.02 : python-requests Vulnerability (NS-SA-2024-0058)	Nessus	NewStart CGSL Local Security Checks	medium
84129	Amazon Linux AMI : python-pip (ALAS-2015-541)	Nessus	Amazon Linux Local Security Checks	medium
82859	Amazon Linux AMI : python-botocore (ALAS-2015-512)	Nessus	Amazon Linux Local Security Checks	medium
82386	Mandriva Linux Security Advisory : python-requests (MDVSA-2015:133)	Nessus	Mandriva Local Security Checks	medium
82308	Fedora 21 : python-requests-2.5.3-2.fc21 / python-urllib3-1.10.2-1.fc21 (2015-4084)	Nessus	Fedora Local Security Checks	medium
81879	Ubuntu 14.04 LTS : Requests vulnerability (USN-2531-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-2296

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium