https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:29:30 +0000 https://vulnerability.circl.lu/vuln/brew-jupyterlab-ghsa-wwv5-g3v4-889x <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary The CVE-2026-35536 fix added a validation loop that rejects `[\x00-\x20\x3b\x7f]`, but only for the hardcoded **lowercase** keys `name`/`domain`/`path`/`samesite`. The still-live deprecated `**kwargs` path writes attacker-supplied attribute values straight into the `Morsel` with no validation, and because `Morsel.__setitem__` is case-insensitive, a capitalized kwarg (`Domain=`, `Path=`, `SameSite=`, `Max-Age=`) routes to the same reserved attribute while bypassing the loop — re-opening `;`-delimited attribute injection.</p> <p>```python self.set_cookie(&#34;sid&#34;, &#34;abc&#34;, Domain=&#34;evil.com; Secure; SameSite=None&#34;) # -&gt; Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/ # Sanity (the canonical lowercase named arg IS blocked): self.set_cookie(&#34;sid&#34;, &#34;abc&#34;, domain=&#34;evil.com; Secure&#34;) # -&gt; http.cookies.CookieError ```</p> <p>The patch&#39;s regression test (`SetCookieForbiddenCharHandler`) only exercises the four named params, never the `**kwargs` path, so the gap is not regression-covered.</p> <p>## Affected code - `tornado/web.py` → `RequestHandler.set_cookie`: the validation loop covers only the lowercase named args; the trailing `if kwargs:` loop does `morsel[k] = v` with no character validation.</p> <p>## Steps to reproduce `GET /upper` (uses `Domain=` kwarg) emits `Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/`; `GET /lower` (uses lowercase `domain=`) returns a `CookieError`.</p> <p>## Impact Injection of independent cookie attributes (force/drop `Secure`/`…</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary The CVE-2026-35536 fix added a validation loop that rejects `[\x00-\x20\x3b\x7f]`, but only for the hardcoded **lowercase** keys `name`/`domain`/`path`/`samesite`. The still-live deprecated `**kwargs` path writes attacker-supplied attribute values straight into the `Morsel` with no validation, and because `Morsel.__setitem__` is case-insensitive, a capitalized kwarg (`Domain=`, `Path=`, `SameSite=`, `Max-Age=`) routes to the same reserved attribute while bypassing the loop — re-opening `;`-delimited attribute injection.</p> <p>```python self.set_cookie(&#34;sid&#34;, &#34;abc&#34;, Domain=&#34;evil.com; Secure; SameSite=None&#34;) # -&gt; Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/ # Sanity (the canonical lowercase named arg IS blocked): self.set_cookie(&#34;sid&#34;, &#34;abc&#34;, domain=&#34;evil.com; Secure&#34;) # -&gt; http.cookies.CookieError ```</p> <p>The patch&#39;s regression test (`SetCookieForbiddenCharHandler`) only exercises the four named params, never the `**kwargs` path, so the gap is not regression-covered.</p> <p>## Affected code - `tornado/web.py` → `RequestHandler.set_cookie`: the validation loop covers only the lowercase named args; the trailing `if kwargs:` loop does `morsel[k] = v` with no character validation.</p> <p>## Steps to reproduce `GET /upper` (uses `Domain=` kwarg) emits `Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/`; `GET /lower` (uses lowercase `domain=`) returns a `CookieError`.</p> <p>## Impact Injection of independent cookie attributes (force/drop `Secure`/`…</p> https://vulnerability.circl.lu/vuln/brew-jupyterlab-ghsa-wwv5-g3v4-889x https://vulnerability.circl.lu/vuln/cleanstart-2026-ms68027 <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>ghsa-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>ghsa-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-ms68027