GHSA-gm98-g2wf-7c68
Suggest an improvement- Source
- https://github.com/advisories/GHSA-gm98-g2wf-7c68
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-gm98-g2wf-7c68/GHSA-gm98-g2wf-7c68.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-gm98-g2wf-7c68
- Published
- 2024-05-15T17:52:00Z
- Modified
- 2024-11-29T05:25:36Z
- Summary
- amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance
- Details
-
In artax version before 1.0.6 and 2 before 2.0.6, cookies of
foo.bar.example.comwere leaked tofoo.bar. Additionally, any site could set cookies for any other site. Artax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, but not on any public suffixes. - Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2024-05-15T17:52:00Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/amphp/artax/commit/25668b891d2bced567bd69611c7d18b6a93d5fc4
- https://github.com/amphp/artax/commit/accdadaf78f7a43305c3a97d6a964bbc550a555d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/2017-05-09.yaml
- https://github.com/amphp/artax
- https://github.com/amphp/artax/releases/tag/v2.0.6
Affected packages
Packagist / amphp/artax
Package
- Name
- amphp/artax
- Purl
- pkg:composer/amphp/artax
Packagist / amphp/artax
Package
- Name
- amphp/artax
- Purl
- pkg:composer/amphp/artax
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.0.6