PT-2024-40303 · Artax · Artax

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions artax versions prior to 1.0.6 artax versions 2 prior to 2.0.6

Description The issue allowed cookies of foo.bar.example.com to be leaked to foo.bar. Furthermore, any site could set cookies for any other site. This was resolved by artax following newer browser implementations, which now restrict cookie setting to domains higher or equal to the current domain, excluding public suffixes.

Recommendations For artax versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue. For artax versions 2 prior to 2.0.6, update to version 2.0.6 or later to resolve the issue.

Related Identifiers

GHSA-GM98-G2WF-7C68

Affected Products

Artax

References · 6

• https://osv.dev/vulnerability/GHSA-gm98-g2wf-7c68 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/2017-05-09.yaml · Note
• https://github.com/amphp/artax/commit/accdadaf78f7a43305c3a97d6a964bbc550a555d · Note
• https://github.com/amphp/artax/releases/tag/v2.0.6 · Note
• https://github.com/amphp/artax/commit/25668b891d2bced567bd69611c7d18b6a93d5fc4 · Note
• https://github.com/amphp/artax · Note