==========================================================================
Ubuntu Security Notice USN-2531-1
March 16, 2015
requests vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.10
– Ubuntu 14.04 LTS
Summary:
Requests could be made to expose cookies over the network.
Software Description:
– requests: elegant and simple HTTP library for Python
Details:
Matthew Daley discovered that Requests incorrectly handled cookies without
host values when being redirected. A remote attacker could possibly use
this issue to perform session fixation or cookie stealing attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.10:
python-requests 2.3.0-1ubuntu0.1
python3-requests 2.3.0-1ubuntu0.1
Ubuntu 14.04 LTS:
python-requests 2.2.1-1ubuntu0.2
python3-requests 2.2.1-1ubuntu0.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2531-1
CVE-2015-2296
Package Information:
https://launchpad.net/ubuntu/+source/requests/2.3.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/requests/2.2.1-1ubuntu0.2
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJVBt+lAAoJEGVp2FWnRL6TTYYP/ihUB8aIUlMRN0gY5M2n/NBO
LVAPHERglZr3cwg6INo0RFe9T7/tbrA1OTqI2TTcLbHmdNzA3aIbf3/Tb8DPAu5R
4CZIPvsM8NWvLgTEr+XRHAb1+Y5wdYarOXM1imC42Uvh4IVG3vZgs0LrCgXU31Od
sq28vrsEEd2EmFUeEnzNhp3HUMAMIZ9OYnoEpEgykXGxRmKTzlKcaMIs/VkjwZo4
X4DVu2dPBe38mfpiFGvmqE2dhC6aammQF6lnuxkNThDdaAD8c0AUKX4GkLm2j8c/
jvsjyEK2LldHF2TjkcO0ttL4wxR9ns05kRk9FP0xlIwqXV1NUFPjnls2VHwkHB6w
R4D/2H48m4xh0QBx9uIitfkr2FEPEX0QEu8FdnsxbQSpl5+OHGvjgzldgiJx2LNx
n7SMRD1fKglmfX6smKNKwafst3W24CvTcT2Yxq3hTqw55b8ocmQsSkp4/v9clU0i
ayMoSLB9I0Y0HmRPwgqSI6UW5XCSqFEAfkQPHM8KbW0qqUHDDNMHJH0ecV097kPj
uxXjnxydEsxkdouqZ5noG2oqh3HW3HU9w512ejURtYESqhWKsObPrbiHJBPiO+7m
UKOiEC6BXB2scdJL6qaP9bu3Od4uvu2aRXqOiqP4o3mI3q5mmfJJ5b5OqNrl2yO3
aZJ9RlqVOSpPeXJadQ/E
=NGWU
—–END PGP SIGNATURE—–
—
