CVE catalog

CVE-2015-2296

requests: CVE-2015-2296

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.18% · Oct 25, 2026

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrequestssid2.34.2-1fixed
Debianrequestsforky2.34.2-1fixed
Debianrequeststrixie2.32.3+dfsg-5+deb13u1fixed
Debianrequestsbookworm2.28.1+dfsg-1fixed
Ubunturequests14.041.2.3-1vulnerable
Ubunturequests14.042.0.0-1vulnerable
Ubunturequests14.042.2.1-1vulnerable
Ubunturequests14.042.2.1-1ubuntu0.1vulnerable
Ubunturequests14.042.2.1-1ubuntu0.2fixed
Susepython-requestsopenstack cloud 52.3.0-9.2fixed
Susepython-requestslinux enterprise desktop 12 sp12.8.1-6.9.1fixed
Susepython-requestslinux enterprise high availability extension 122.8.1-6.9.1fixed
Susepython-requestslinux enterprise module for public cloud 122.8.1-6.9.1fixed
Susepython-requestslinux enterprise server 122.8.1-6.9.1fixed
Susepython-requestslinux enterprise server for sap applications 122.8.1-6.9.1fixed
Susepython-requestslinux enterprise server 12 sp12.8.1-6.9.1fixed
Susepython-requestslinux enterprise server for sap applications 12 sp12.8.1-6.9.1fixed
Susepython-requestscloud compute node for suse linux enterprise 12 52.8.1-6.9.1fixed
Susepython-requestsenterprise storage 1.02.8.1-6.9.1fixed
Susepython-requestsenterprise storage 22.8.1-6.9.1fixed
Susepython-certifihpe helion openstack 82018.4.16-3.6.1fixed
Susepython-chardethpe helion openstack 83.0.4-5.6.1fixed
Susepython-urllib3hpe helion openstack 81.22-3.20.1fixed
Susepython3-requestshpe helion openstack 82.20.1-5.2fixed
Susepython-certifiopenstack cloud 72018.4.16-3.6.1fixed
Susepython-chardetopenstack cloud 73.0.4-5.6.1fixed
Susepython-urllib3openstack cloud 71.22-3.20.1fixed
Susepython3-requestsopenstack cloud 72.20.1-5.2fixed
Susepython-certifiopenstack cloud 82018.4.16-3.6.1fixed
Susepython-chardetopenstack cloud 83.0.4-5.6.1fixed
Susepython-urllib3openstack cloud 81.22-3.20.1fixed
Susepython3-requestsopenstack cloud 82.20.1-5.2fixed
Susepython-certifiopenstack cloud crowbar 82018.4.16-3.6.1fixed
Susepython-chardetopenstack cloud crowbar 83.0.4-5.6.1fixed
Susepython-urllib3openstack cloud crowbar 81.22-3.20.1fixed
Susepython3-requestsopenstack cloud crowbar 82.20.1-5.2fixed
Susepython-certifilinux enterprise module for public cloud 122018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise module for public cloud 123.0.4-5.6.1fixed
Susepython-urllib3linux enterprise module for public cloud 121.22-3.20.1fixed
Susepython-certifilinux enterprise server for sap applications 12 sp22018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server for sap applications 12 sp23.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server for sap applications 12 sp21.22-3.20.1fixed
Susepython3-requestslinux enterprise server for sap applications 12 sp22.20.1-5.2fixed
Susepython-certifilinux enterprise server for sap applications 12 sp32018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server for sap applications 12 sp33.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server for sap applications 12 sp31.22-3.20.1fixed
Susepython3-requestslinux enterprise server for sap applications 12 sp32.20.1-5.2fixed
Susepython-certifilinux enterprise software development kit 12 sp52018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise software development kit 12 sp53.0.4-5.6.1fixed
Susepython-urllib3linux enterprise software development kit 12 sp51.22-3.20.1fixed
Susepython3-requestslinux enterprise software development kit 12 sp52.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp2-ltss2018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp2-ltss3.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp2-ltss1.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp2-ltss2.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp2-bcl2018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp2-bcl3.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp2-bcl1.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp2-bcl2.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp3-ltss2018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp3-ltss3.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp3-ltss1.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp3-ltss2.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp3-bcl2018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp3-bcl3.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp3-bcl1.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp3-bcl2.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp42018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp43.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp41.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp42.20.1-5.2fixed
Susepython-certifilinux enterprise server for sap applications 12 sp42018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server for sap applications 12 sp43.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server for sap applications 12 sp41.22-3.20.1fixed
Susepython3-requestslinux enterprise server for sap applications 12 sp42.20.1-5.2fixed
Susepython-certifilinux enterprise server 12 sp52018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server 12 sp53.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server 12 sp51.22-3.20.1fixed
Susepython3-requestslinux enterprise server 12 sp52.20.1-5.2fixed
Susepython-certifilinux enterprise server for sap applications 12 sp52018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise server for sap applications 12 sp53.0.4-5.6.1fixed
Susepython-urllib3linux enterprise server for sap applications 12 sp51.22-3.20.1fixed
Susepython3-requestslinux enterprise server for sap applications 12 sp52.20.1-5.2fixed
Susepython-certifilinux enterprise workstation extension 12 sp52018.4.16-3.6.1fixed
Susepython-chardetlinux enterprise workstation extension 12 sp53.0.4-5.6.1fixed
Susepython-urllib3linux enterprise workstation extension 12 sp51.22-3.20.1fixed
Susepython3-requestslinux enterprise workstation extension 12 sp52.20.1-5.2fixed
Susepython-certifimanager proxy 3.22018.4.16-3.6.1fixed
Susepython-chardetmanager proxy 3.23.0.4-5.6.1fixed
Susepython-urllib3manager proxy 3.21.22-3.20.1fixed
Susepython3-requestsmanager proxy 3.22.20.1-5.2fixed
Susepython-certifimanager server 3.22018.4.16-3.6.1fixed
Susepython-chardetmanager server 3.23.0.4-5.6.1fixed
Susepython-urllib3manager server 3.21.22-3.20.1fixed
Susepython3-requestsmanager server 3.22.20.1-5.2fixed
Susepython-certifienterprise storage 52018.4.16-3.6.1fixed
Susepython-chardetenterprise storage 53.0.4-5.6.1fixed
Susepython-urllib3enterprise storage 51.22-3.20.1fixed
Susepython3-requestsenterprise storage 52.20.1-5.2fixed
Ubunturequests14.041.2.3-1vulnerable
Ubunturequests14.042.0.0-1vulnerable
Ubunturequests14.042.2.1-1vulnerable
Ubunturequests14.042.2.1-1ubuntu0.1vulnerable
Ubunturequests14.042.2.1-1ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrequestssourcesid2.4.3-6not yet assignedNot reported[780506]
Debianrequestssourceforky2.4.3-6not yet assignedNot reported[780506]
Debianrequestssourcetrixie2.4.3-6not yet assignedNot reported[780506]
Debianrequestssourcebookworm2.4.3-6not yet assignedNot reported[780506]
Ubunturequestsdeb14.042.2.1-1ubuntu0.2Not reportedUSN-2531-1Not reported
Susepython-requestsrpmopenstack cloud 52.3.0-9.2Not reportedSUSE-SU-2015:2156-1Not reported
Susepython-requestsrpmlinux enterprise desktop 12 sp12.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise high availability extension 122.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise module for public cloud 122.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise server 122.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 122.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise server 12 sp12.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmlinux enterprise server for sap applications 12 sp12.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmcloud compute node for suse linux enterprise 12 52.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmenterprise storage 1.02.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-requestsrpmenterprise storage 22.8.1-6.9.1Not reportedSUSE-SU-2016:0114-1Not reported
Susepython-certifirpmhpe helion openstack 82018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmhpe helion openstack 83.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmhpe helion openstack 81.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmhpe helion openstack 82.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmopenstack cloud 72018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmopenstack cloud 73.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmopenstack cloud 71.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmopenstack cloud 72.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmopenstack cloud 82018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmopenstack cloud 83.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmopenstack cloud 81.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmopenstack cloud 82.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmopenstack cloud crowbar 82018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmopenstack cloud crowbar 83.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmopenstack cloud crowbar 81.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmopenstack cloud crowbar 82.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise module for public cloud 122018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise module for public cloud 123.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise module for public cloud 121.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server for sap applications 12 sp22018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server for sap applications 12 sp23.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server for sap applications 12 sp21.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server for sap applications 12 sp22.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server for sap applications 12 sp32018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server for sap applications 12 sp33.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server for sap applications 12 sp31.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server for sap applications 12 sp32.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise software development kit 12 sp52018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise software development kit 12 sp53.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise software development kit 12 sp51.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise software development kit 12 sp52.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp2-ltss2018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp2-ltss3.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp2-ltss1.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp2-ltss2.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp2-bcl2018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp2-bcl3.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp2-bcl1.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp2-bcl2.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp3-ltss2018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp3-ltss3.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp3-ltss1.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp3-ltss2.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp3-bcl2018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp3-bcl3.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp3-bcl1.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp3-bcl2.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp42018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp43.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp41.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp42.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server for sap applications 12 sp42018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server for sap applications 12 sp43.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server for sap applications 12 sp41.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server for sap applications 12 sp42.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server 12 sp52018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server 12 sp53.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server 12 sp51.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server 12 sp52.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise server for sap applications 12 sp52018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise server for sap applications 12 sp53.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise server for sap applications 12 sp51.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise server for sap applications 12 sp52.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmlinux enterprise workstation extension 12 sp52018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmlinux enterprise workstation extension 12 sp53.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmlinux enterprise workstation extension 12 sp51.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmlinux enterprise workstation extension 12 sp52.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmmanager proxy 3.22018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmmanager proxy 3.23.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmmanager proxy 3.21.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmmanager proxy 3.22.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmmanager server 3.22018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmmanager server 3.23.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmmanager server 3.21.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmmanager server 3.22.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-certifirpmenterprise storage 52018.4.16-3.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-chardetrpmenterprise storage 53.0.4-5.6.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython-urllib3rpmenterprise storage 51.22-3.20.1Not reportedSUSE-SU-2020:1792-1Not reported
Susepython3-requestsrpmenterprise storage 52.20.1-5.2Not reportedSUSE-SU-2020:1792-1Not reported
Ubunturequestsdeb14.042.2.1-1ubuntu0.2Not reportedUBUNTU-CVE-2015-2296Not reported

[Debian bug #780506]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [requests]

    Details (2)
    • 2.28.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · bookworm; dsa · requests · debian · 12

    • 2.28.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · bookworm; dsa · requests · debian · 12

  • Source package: [requests]

    Details (2)
    • 2.28.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · bookworm; dsa · requests · debian · 12

    • 2.28.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · bookworm; dsa · requests · debian · 12

[Debian 13 (Trixie)]

  • Source package: [requests]

    Details (2)
    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · 13

    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · 13

  • Source package: [requests]

    Details (2)
    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · 13

    • 2.32.3+dfsg-5+deb13u1 · all · trixie

      Fixed · Fixed: 2.4.3-6

      dsa · requests · debian · 13

Observed:

References