CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Résumé
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-2756 php7.4 Corrigé dans: 7.4.33-1+deb11u5
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web openwall.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org