==========================================================================
Ubuntu Security Notice USN-2531-1
March 16, 2015

requests vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.10
– Ubuntu 14.04 LTS

Summary:

Requests could be made to expose cookies over the network.

Software Description:
– requests: elegant and simple HTTP library for Python

Details:

Matthew Daley discovered that Requests incorrectly handled cookies without
host values when being redirected. A remote attacker could possibly use
this issue to perform session fixation or cookie stealing attacks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
python-requests 2.3.0-1ubuntu0.1
python3-requests 2.3.0-1ubuntu0.1

Ubuntu 14.04 LTS:
python-requests 2.2.1-1ubuntu0.2
python3-requests 2.2.1-1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2531-1
CVE-2015-2296

Package Information:
https://launchpad.net/ubuntu/+source/requests/2.3.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/requests/2.2.1-1ubuntu0.2

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJVBt+lAAoJEGVp2FWnRL6TTYYP/ihUB8aIUlMRN0gY5M2n/NBO
LVAPHERglZr3cwg6INo0RFe9T7/tbrA1OTqI2TTcLbHmdNzA3aIbf3/Tb8DPAu5R
4CZIPvsM8NWvLgTEr+XRHAb1+Y5wdYarOXM1imC42Uvh4IVG3vZgs0LrCgXU31Od
sq28vrsEEd2EmFUeEnzNhp3HUMAMIZ9OYnoEpEgykXGxRmKTzlKcaMIs/VkjwZo4
X4DVu2dPBe38mfpiFGvmqE2dhC6aammQF6lnuxkNThDdaAD8c0AUKX4GkLm2j8c/
jvsjyEK2LldHF2TjkcO0ttL4wxR9ns05kRk9FP0xlIwqXV1NUFPjnls2VHwkHB6w
R4D/2H48m4xh0QBx9uIitfkr2FEPEX0QEu8FdnsxbQSpl5+OHGvjgzldgiJx2LNx
n7SMRD1fKglmfX6smKNKwafst3W24CvTcT2Yxq3hTqw55b8ocmQsSkp4/v9clU0i
ayMoSLB9I0Y0HmRPwgqSI6UW5XCSqFEAfkQPHM8KbW0qqUHDDNMHJH0ecV097kPj
uxXjnxydEsxkdouqZ5noG2oqh3HW3HU9w512ejURtYESqhWKsObPrbiHJBPiO+7m
UKOiEC6BXB2scdJL6qaP9bu3Od4uvu2aRXqOiqP4o3mI3q5mmfJJ5b5OqNrl2yO3
aZJ9RlqVOSpPeXJadQ/E
=NGWU
—–END PGP SIGNATURE—–
—