GHSA-p8f7-22gq-m7j9

Phoenix before 1.6.14 mishandles check_origin wildcarding

Source: GitHub Advisory Database (reviewed) High CVE-2022-42975

Packages

Ecosystem	Package	Affected	Fixed in
Hex	phoenix	< 1.6.14	1.6.14

Details

As written in the advisory (Markdown source, shown as plain text).

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-42975 advisory
https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae web
https://github.com/phoenixframework/phoenix package
https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10 web