[Bug 1432555] Re: Please fix handling of cookies on redirect

[Launchpad Bug Tracker]

This bug was fixed in the package requests - 2.3.0-1ubuntu0.1

---------------
requests (2.3.0-1ubuntu0.1) utopic-security; urgency=medium

  * SECURITY UPDATE: Session fixation and cookie stealing issue
    (LP: #1432555).
    - debian/patches/CVE-2015-2296.patch: extract cookies from the original
      request (which still has the host which returned the cookies)
    - CVE-2015-2296
 -- Daniel Watkins <daniel.watkins at canonical.com>   Mon, 16 Mar 2015 10:37:44 +0000

** Changed in: requests (Ubuntu Utopic)
       Status: Confirmed => Fix Released

** Changed in: requests (Ubuntu Trusty)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to requests in Ubuntu.
https://bugs.launchpad.net/bugs/1432555

Title:
  Please fix handling of cookies on redirect

Status in requests package in Ubuntu:
  Confirmed
Status in requests source package in Precise:
  Invalid
Status in requests source package in Trusty:
  Fix Released
Status in requests source package in Utopic:
  Fix Released
Status in requests source package in Vivid:
  Confirmed
Status in requests package in Debian:
  Unknown

Bug description:
  Requests 2.6.0 includes a fix for CVE-2015-2296[0] which is present in
  all versions of python-requests in Ubuntu since trusty. For more
  information, see the CVE requests at [1].

  I believe that the fix happens in the commit in [2].

  
  [0] http://docs.python-requests.org/en/latest/community/updates/#id1
  [1] http://www.openwall.com/lists/oss-security/2015/03/14/4
  [2] https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/requests/+bug/1432555/+subscriptions