FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-treq -- sensitive information leak vulnerability

Affected packages
py310-treq < 22.1.0
py311-treq < 22.1.0
py37-treq < 22.1.0
py38-treq < 22.1.0
py39-treq < 22.1.0


VuXML ID 181f5e49-b71d-4527-9464-d4624d69acc3
Discovery 2022-02-01
Entry 2023-08-31

Treq's request methods (`treq.get`, ``, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary.

Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies").

This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `` redirect to `` the latter will receive the cookie `session`.


CVE Name CVE-2022-23607