Vulnerability	Vulnerable Version
M Information Exposure treq is a High-level Twisted HTTP Client API Affected versions of this package are vulnerable to Information Exposure when Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary, Such cookies are not bound to a single domain and are therefore sent to every domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`. How to fix Information Exposure? Upgrade `treq` to version 22.1.0 or higher.	[,22.1.0)

Information Exposure

treq is a High-level Twisted HTTP Client API

Affected versions of this package are vulnerable to Information Exposure when Treq's request methods (treq.get, treq.post, HTTPClient.request, HTTPClient.get, etc.) accept cookies as a dictionary,

Such cookies are not bound to a single domain and are therefore sent to every domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should https://example.com redirect to http://cloudstorageprovider.com the latter will receive the cookie session.

How to fix Information Exposure?

Upgrade treq to version 22.1.0 or higher.

[,22.1.0)

Go back to all versions of this package