GHSA-mjw4-xvx6-3grg

rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Source: GitHub Advisory Database (reviewed) High CVE-2022-3174

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	>= 2.4.1, < 2.4.2	2.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3174 advisory
https://github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e web
https://github.com/advisories/GHSA-mjw4-xvx6-3grg advisory
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-271.yaml web
https://huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce web