FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-treq -- sensitive information leak vulnerability

Affected packages
	py310-treq	<	22.1.0
	py311-treq	<	22.1.0
	py37-treq	<	22.1.0
	py38-treq	<	22.1.0
	py39-treq	<	22.1.0

Details

VuXML ID	181f5e49-b71d-4527-9464-d4624d69acc3
Discovery	2022-02-01
Entry	2023-08-31

Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary.

Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies").

This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.

[source]

References

CVE Name	CVE-2022-23607
URL	https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc