Описание
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-infra-legacy/trusty | not-affected | code not present |
| esm-infra-legacy/xenial | released | 7.47.0-1ubuntu2.19+esm16 |
| esm-infra/bionic | released | 7.58.0-2ubuntu3.24+esm9 |
| esm-infra/focal | released | 7.68.0-1ubuntu2.25+esm4 |
| jammy | released | 7.81.0-1ubuntu1.25 |
| noble | released | 8.5.0-2ubuntu10.10 |
| questing | released | 8.14.1-2ubuntu1.4 |
| resolute | released | 8.18.0-1ubuntu2.2 |
| upstream | pending | 8.20.0 |
Показывать по
9.1 Critical
CVSS3
Связанные уязвимости
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
A flaw in curl\u2019s cookie parsing logic allows a malicious HTTP ser ...
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
9.1 Critical
CVSS3