Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host. Impact Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls. Preconditions - Application uses the CookieJar client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring. Workarounds - Do not use the CookieJar with clients that fetch attacker-influenced URLs - Apply a separate CookieJar per trusted origin.
Recommended action: Upgrade to 1.0.0-M47 (pre-release) or 0.23.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies. Impact Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client. Preconditions - Application uses the CookieJar client middleware. - Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts. Workarounds - Do not share a CookieJar across trusted and untrusted targets. Note This middleware still does not implement public suffix rejection.
Recommended action: Upgrade to 1.0.0-M47 (pre-release) or 0.23.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.