stale custom cookie host causes cookie leak
Platform
c
Component
curl
Fixed in
8.19.1
Using libcurl, when a custom Host: header is first set for an HTTP request
and a second request is subsequently done using the same easy handle but
without the custom Host: header set, the second request would use stale
information and pass on cookies meant for the first host in the second
request. Leak them.
Threat Intelligence
Exploit Status
EPSS
0.01% (1% percentile)
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- EPSS updated
How to fix
Actualice a la versión 8.19.1 o posterior de libcurl para evitar la fuga de cookies. Esta vulnerabilidad ocurre cuando se utiliza un encabezado 'Host' personalizado y se realiza una segunda solicitud sin él, lo que puede llevar a que se utilicen cookies incorrectas.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...