PT-2022-16122 · Treq+1 · Treq+1

Published 2022-02-01 · Updated 2025-05-17 · CVE-2022-23607

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions treq versions prior to 2021.1.0

Description The treq library's request methods (treq.get, treq.post, etc.) and treq.client.HTTPClient constructor accept cookies as a dictionary. These cookies are not bound to a single domain and are sent to every domain, potentially causing sensitive information to leak upon an HTTP redirect to a different domain. For example, if https://example.com redirects to http://cloudstorageprovider.com, the latter will receive the session cookie.

Recommendations For versions prior to 2021.1.0, instead of passing a dictionary as the cookies argument, pass a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies in it. Upgrade to treq version 2021.1.0 or later, which binds cookies given to request methods to the origin of the url parameter.

Exploit

Fix

Information Disclosure

Open Redirect

Weakness Enumeration

CWE-425

CWE-200

CWE-601

Related Identifiers

CVE-2022-23607

DLA-2954-1

GHSA-FHPF-PP6P-55QC

OPENSUSE-SU-2022:10098-1

OPENSUSE-SU-2024:11806-1

OPENSUSE-SU-2025:15106-1

PYSEC-2022-26

Affected Products

Debian

Treq

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23607.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-23607 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11806-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23607 · Security Note
• https://osv.dev/vulnerability/DLA-2954-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23607 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10098-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23607 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15106-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-26 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fhpf-pp6p-55qc · Vendor Advisory
• https://github.com/twisted/treq/security/advisories/GHSA-fhpf-pp6p-55qc · Note