GHSA-gm98-g2wf-7c68 json
amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance
published 2y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
In artax version before 1.0.6 and 2 before 2.0.6, cookies of `foo.bar.example.com` were leaked to `foo.bar`. Additionally, any site could set cookies for any other site. Artax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, but not on any public suffixes.
Patch / fix
- packagist amphp/artax 1.0.6, 2.0.6
Is GHSA-gm98-g2wf-7c68 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | amphp/artax | >=2, <2.0.6 <1.0.6 |
2.0.6 1.0.6 |
References
-
github.com
/amphp/artax/commit/25668b891d2bced567bd69611c7d18b6a93d5fc4
web
-
github.com
/amphp/artax/commit/accdadaf78f7a43305c3a97d6a964bbc550a555d
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/amphp/artax/2017-05-09.yaml
web
-
github.com
/amphp/artax
package
-
github.com
/amphp/artax/releases/tag/v2.0.6
web
Sources
- GitHub Advisory GHSA-gm98-g2wf-7c68
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.