CVE-2015-2296

Name of the Vulnerable Software and Affected Versions requests versions 2.1.0 through 2.5.3

Description The issue allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. This is due to a problem in the resolve redirects function in sessions.py.

Recommendations For requests versions 2.1.0 through 2.5.3, consider updating to a version where this issue is fixed, as the current version allows session fixation attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.