Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-59883 →
DEBIAN-CVE-2026-59883
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.3-1"}]}]
Références
- advisory security-tracker.debian.org