treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url* parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped cookies in it.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request
    methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a
    dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain
    ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a
    different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the
    latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods
    (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*
    parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as
    the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped
    cookies in it. (CVE-2022-23607)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 181f5e49-b71d-4527-9464-d4624d69acc3 advisory.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2954 advisory.

  - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request     methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a     dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain     (supercookies). This can potentially cause sensitive information to leak upon an HTTP redirect to a     different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the     latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods     (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url*     parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as     the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped     cookies in it. (CVE-2022-23607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
439107	Alpine: multiple py3-treq packages: security update to 22.1.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
439107	Alpine: multiple py3-treq packages: security update to 22.1.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
230089	Linux Distros Unpatched Vulnerability : CVE-2022-23607	Nessus	Misc.	medium
414535	SCA: security update for treq (GHSA-fhpf-pp6p-55qc)	Tenable Cloud Security	SCA Checks	high
414535	SCA: security update for treq (GHSA-fhpf-pp6p-55qc)	Tenable Self-Hosted Container Security	SCA Checks	high
180364	FreeBSD : py-treq -- sensitive information leak vulnerability (181f5e49-b71d-4527-9464-d4624d69acc3)	Nessus	FreeBSD Local Security Checks	medium
159069	Debian DLA-2954-1 : python-treq - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-23607

high

Tenable Plugins

high

high

medium

high

high

medium

medium