There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to
    conduct session fixation attacks via a cookie without a host value in a redirect. (CVE-2015-2296)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2531-1 advisory.

    Matthew Daley discovered that Requests incorrectly handled cookies without host values when being     redirected. A remote attacker could possibly use this issue to perform session fixation or cookie stealing     attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL.

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0187 advisory.

    This advisory aggregates security fixes for the python-requests SRPM in CIQ LTS 8.6. It addresses 6 CVEs:
    CVE-2015-20107, CVE-2023-32681, CVE-2022-45061, CVE-2023-24329, CVE-2018-18074, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Backport of patch to not ascribe cookies to the target domain.

  -     https://github.com/kennethreitz/requests/commit/3bd8afbf     f29e50b38f889b2f688785a669b9aafc

  - http://www.openwall.com/lists/oss-security/2015/03/14/4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated python-requests packages fix security vulnerabilities :

Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their passwords stored in the ~/.netrc file (CVE-2014-1829).

It was discovered that the python-requests Proxy-Authorization header was never re-evaluated when a redirect occurs. The Proxy-Authorization header was sent to any new proxy or non-proxy destination as redirected (CVE-2014-1830).

In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing (CVE-2015-2296).

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0248 advisory.

    This advisory aggregates security fixes for the python-requests SRPM in CIQ LTS 8.6. It addresses 3 CVEs:
    CVE-2023-32681, CVE-2018-18074, CVE-2015-2296.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has python-requests packages installed that are affected by a vulnerability:

  - A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A     remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL. (CVE-2015-2296)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
432326	SCA: security update for requests (GHSA-pg2w-x9wp-vw92)	Tenable Cloud Security	SCA Checks	8/8/2025	7/2/2026	medium
432326	SCA: security update for requests (GHSA-pg2w-x9wp-vw92)	Tenable Self-Hosted Container Security	SCA Checks	8/8/2025	7/2/2026	medium
81879	Ubuntu 14.04 LTS : Requests vulnerability (USN-2531-1)	Nessus	Ubuntu Local Security Checks	3/17/2015	8/27/2024	medium
82859	Amazon Linux AMI : python-botocore (ALAS-2015-512)	Nessus	Amazon Linux Local Security Checks	4/20/2015	4/18/2018	medium
84129	Amazon Linux AMI : python-pip (ALAS-2015-541)	Nessus	Amazon Linux Local Security Checks	6/12/2015	4/18/2018	medium
355588	Rocky Linux 8.6 [CIQ] Security Update: python2-requests Multiple Vulnerabilities (ciqsa-2026_0187)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/11/2026	high
82308	Fedora 21 : python-requests-2.5.3-2.fc21 / python-urllib3-1.10.2-1.fc21 (2015-4084)	Nessus	Fedora Local Security Checks	3/30/2015	1/11/2021	medium
82386	Mandriva Linux Security Advisory : python-requests (MDVSA-2015:133)	Nessus	Mandriva Local Security Checks	3/30/2015	1/14/2021	medium
354002	Rocky Linux 8.6 [CIQ] Security Update: python3-requests Multiple Vulnerabilities (ciqsa-2026_0248)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/11/2026	high
206827	NewStart CGSL MAIN 6.02 : python-requests Vulnerability (NS-SA-2024-0058)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	9/10/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

medium

medium

high

medium