The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2296
Reference (s):
- http://advisories.mageia.org/MGASA-2015-0120.html
- https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
- https://warehouse.python.org/project/requests/2.6.0/
- FEDORA:FEDORA-2015-4084
- URL: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html