Security update for python-requests SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0114-1 Final 1 1 2016-01-13T20:05:42Z current 2016-01-13T20:05:42Z 2016-01-13T20:05:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-requests The python-requests module has been updated to version 2.8.1, which brings several fixes and enhancements: - Fix handling of cookies on redirect. Previously a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing. (bsc#922448, CVE-2015-2296) - Add support for per-host proxies. This allows the proxies dictionary to have entries of the form {'<scheme>://<hostname>': '<proxy>'}. Host-specific proxies will be used in preference to the previously-supported scheme-specific ones, but the previous syntax will continue to work. - Update certificate bundle to match 'certifi' 2015.9.6.2's weak certificate bundle. - Response.raise_for_status now prints the URL that failed as part of the exception message. - requests.utils.get_netrc_auth now takes an raise_errors kwarg, defaulting to False. When True, errors parsing .netrc files cause exceptions to be thrown. - Change to bundled projects import logic to make it easier to unbundle requests downstream. - Change the default User-Agent string to avoid leaking data on Linux: now contains only the requests version. - The json parameter to post() and friends will now only be used if neither data nor files are present, consistent with the documentation. - Empty fields in the NO_PROXY environment variable are now ignored. - Fix problem where httplib.BadStatusLine would get raised if combining stream=True with contextlib.closing. - Prevent bugs where we would attempt to return the same connection back to the connection pool twice when sending a Chunked body. - Digest Auth support is now thread safe. - Resolved several bugs involving chunked transfer encoding and response framing. - Copy a PreparedRequest's CookieJar more reliably. - Support bytearrays when passed as parameters in the 'files' argument. - Avoid data duplication when creating a request with 'str', 'bytes', or 'bytearray' input to the 'files' argument. - 'Connection: keep-alive' header is now sent automatically. - Support for connect timeouts. Timeout now accepts a tuple (connect, read) which is used to set individual connect and read timeouts. For a comprehensive list of changes please refer to the package's change log or the Release Notes at http://docs.python-requests.org/en/latest/community/updates/#id3 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2016-80,SUSE-SLE-HA-12-2016-80,SUSE-SLE-Module-Public-Cloud-12-2016-80,SUSE-SLE-SERVER-12-2016-80,SUSE-SLE-SERVER-12-SP1-2016-80,SUSE-SLE12-CLOUD-5-2016-80,SUSE-Storage-1.0-2016-80,SUSE-Storage-2-2016-80 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160114-1/ Link for SUSE-SU-2016:0114-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001801.html E-Mail link for SUSE-SU-2016:0114-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/922448 SUSE Bug 922448 https://bugzilla.suse.com/929736 SUSE Bug 929736 https://bugzilla.suse.com/961596 SUSE Bug 961596 https://www.suse.com/security/cve/CVE-2015-2296/ SUSE CVE CVE-2015-2296 page SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5 SUSE Enterprise Storage 1.0 SUSE Enterprise Storage 2 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise High Availability Extension 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 python-requests-2.8.1-6.9.1 python-requests-2.8.1-6.9.1 as a component of SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5 python-requests-2.8.1-6.9.1 as a component of SUSE Enterprise Storage 1.0 python-requests-2.8.1-6.9.1 as a component of SUSE Enterprise Storage 2 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise High Availability Extension 12 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Server 12 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Server 12 SP1 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-requests-2.8.1-6.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. CVE-2015-2296 SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5:python-requests-2.8.1-6.9.1 SUSE Enterprise Storage 1.0:python-requests-2.8.1-6.9.1 SUSE Enterprise Storage 2:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Desktop 12 SP1:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise High Availability Extension 12:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Module for Public Cloud 12:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Server 12 SP1:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Server 12:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:python-requests-2.8.1-6.9.1 SUSE Linux Enterprise Server for SAP Applications 12:python-requests-2.8.1-6.9.1 low 1.8 AV:A/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160114-1/ https://www.suse.com/security/cve/CVE-2015-2296.html CVE-2015-2296 https://bugzilla.suse.com/922448 SUSE Bug 922448 https://bugzilla.suse.com/926396 SUSE Bug 926396