CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Summary
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Original description
The description as published by the source.
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-2756 php7.4 Fixed in: 7.4.33-1+deb11u5
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web openwall.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org