Backport patch to not ascribe cookies to the target domain

python-requests.spec

@@ -6,7 +6,7 @@
 
 Name:           python-requests
 Version:        2.5.3
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        ASL 2.0
@@ -19,6 +19,10 @@ Patch0:         python-requests-system-cert-bundle.patch
 # Remove an unnecessary reference to a bundled compat lib in urllib3
 Patch1:         python-requests-remove-nested-bundling-dep.patch
 
+# Backport fix for CVE-2015-2296
+# https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc
+Patch2:         python-requests-dont-ascribe-cookies.patch
+
 BuildArch:      noarch
 BuildRequires:  python2-devel
 BuildRequires:  python-chardet
@@ -61,6 +65,8 @@ designed to make HTTP requests easy for developers.
 %patch0 -p1
 %patch1 -p1
 
+%patch2 -p1
+
 # Unbundle the certificate bundle from mozilla.
 rm -rf requests/cacert.pem
 
@@ -141,6 +147,9 @@ popd
 %endif
 
 %changelog
+* Mon Mar 16 2015 Ralph Bean <rbean@redhat.com> - 2.5.3-2
+- Backport fix for CVE-2015-2296.
+
 * Thu Feb 26 2015 Ralph Bean <rbean@redhat.com> - 2.5.3-1
 - new version