This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author georg.brandl
Recipients Arfrever, Tim.Graham, berker.peksag, georg.brandl, pitrou, r.david.murray
Date 2014-11-04.17:38:58
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Well, with this change you can again (e.g.) pass

"Set-cookie: foo=bar"

which isn't a valid cookie.  It doesn't reintroduce the same vulnerability, but it will still silently consume invalid cookies (i.e. such with attribute-like tokens upfront) and return a seemingly valid one.

IMO this is questionable behavior of the kind that can enable exploits, which is also why it was disallowed by the fix of the first vulnerability.
Date User Action Args
2014-11-04 17:38:58georg.brandlsetrecipients: + georg.brandl, pitrou, Arfrever, r.david.murray, berker.peksag, Tim.Graham
2014-11-04 17:38:58georg.brandlsetmessageid: <>
2014-11-04 17:38:58georg.brandllinkissue22796 messages
2014-11-04 17:38:58georg.brandlcreate