TI-2024-38585 Aliases GHSA-gm98-g2wf-7c68

amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance

LOW 38Published 2024-05-15 · Updated 2024-05-15

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

In artax version before 1.0.6 and 2 before 2.0.6, cookies of `foo.bar.example.com` were leaked to `foo.bar`. Additionally, any site could set cookies for any other site. Artax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, but not on any public suffixes.

Why it matters now

Fix Fixed amphp/artax (Packagist): 2.0.6, 1.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	amphp/artax (Packagist)	2 to before 2.0.6	2.0.6	Patch available	GHSA-gm98-g2wf-7c68
—	amphp/artax (Packagist)	before 1.0.6	1.0.6	Patch available	GHSA-gm98-g2wf-7c68

amphp/artax (Packagist) Vendor— Affected 2 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-gm98-g2wf-7c68
amphp/artax (Packagist) Vendor— Affected before 1.0.6 Fixed in 1.0.6 Patch available GHSA-gm98-g2wf-7c68

Remediation

Fix · GHSA-gm98-g2wf-7c68 amphp/artax (Packagist) Fixed in 2.0.6 Advisory →
Fix · GHSA-gm98-g2wf-7c68 amphp/artax (Packagist) Fixed in 1.0.6 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-gm98-g2wf-7c68

References

Other 5

Sources

GHSA-gm98-g2wf-7c68 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences