MediumGHSA-gm98-g2wf-7c68
amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance
Published 15 May 2024 · Updated 29 Nov 2024
Affected packages
amphp/artaxComposer
- Affected
- >=2 <2.0.6
- Fixed in
- 2.0.6
Update to the fixed version for your release line, for example:
composer require amphp/artax:^2.0.6amphp/artaxComposer
- Affected
- <1.0.6
- Fixed in
- 1.0.6
Update to the fixed version for your release line, for example:
composer require amphp/artax:^1.0.6Details
In artax version before 1.0.6 and 2 before 2.0.6, cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site.
Artax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, but not on any public suffixes.
Is GHSA-gm98-g2wf-7c68 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected amphp/artax, and gives you the command that fixes it.
References
- Linkgithub.com/amphp/artax/commit/25668b891d2bced567bd69611c7d18b6a93d5fc4
- Linkgithub.com/amphp/artax/commit/accdadaf78f7a43305c3a97d6a964bbc550a555d
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/2017-05-09.yaml
- Packagegithub.com/amphp/artax
- Linkgithub.com/amphp/artax/releases/tag/v2.0.6
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.