Mandriva Linux Security Advisory : python-requests (MDVSA-2015:133)
Medium Nessus Plugin ID 82386
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionUpdated python-requests packages fix security vulnerabilities :
Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their passwords stored in the ~/.netrc file (CVE-2014-1829).
It was discovered that the python-requests Proxy-Authorization header was never re-evaluated when a redirect occurs. The Proxy-Authorization header was sent to any new proxy or non-proxy destination as redirected (CVE-2014-1830).
In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing (CVE-2015-2296).
SolutionUpdate the affected python-requests and / or python3-requests packages.