pysec-2023-57
Vulnerability from pysec
Published
2023-02-14 20:15
Modified
2023-05-04 03:49
Details
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value
instead of key=value
. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad
for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie =__Host-test=bad
as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "werkzeug", "purl": "pkg:pypi/werkzeug" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "cf275f42acad1b5950c50ffe8ef58fe62cdce028" } ], "repo": "https://github.com/pallets/werkzeug", "type": "GIT" }, { "events": [ { "introduced": "0" }, { "fixed": "2.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.1", "0.10", "0.10.1", "0.10.2", "0.10.3", "0.10.4", "0.11", "0.11.1", "0.11.10", "0.11.11", "0.11.12", "0.11.13", "0.11.14", "0.11.15", "0.11.2", "0.11.3", "0.11.4", "0.11.5", "0.11.6", "0.11.7", "0.11.8", "0.11.9", "0.12", "0.12.1", "0.12.2", "0.13", "0.14", "0.14.1", "0.15.0", "0.15.1", "0.15.2", "0.15.3", "0.15.4", "0.15.5", "0.15.6", "0.16.0", "0.16.1", "0.2", "0.3", "0.3.1", "0.4", "0.4.1", "0.5", "0.5.1", "0.6", "0.6.1", "0.6.2", "0.7", "0.7.1", "0.7.2", "0.8", "0.8.1", "0.8.2", "0.8.3", "0.9", "0.9.1", "0.9.2", "0.9.3", "0.9.4", "0.9.5", "0.9.6", "1.0.0", "1.0.0rc1", "1.0.1", "2.0.0", "2.0.0rc1", "2.0.0rc2", "2.0.0rc3", "2.0.0rc4", "2.0.0rc5", "2.0.1", "2.0.2", "2.0.3", "2.1.0", "2.1.1", "2.1.2", "2.2.0", "2.2.0a1", "2.2.1", "2.2.2" ] } ], "aliases": [ "CVE-2023-23934", "GHSA-px8h-6qxv-m22q" ], "details": "Werkzeug is a comprehensive WSGI web application library. Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.", "id": "PYSEC-2023-57", "modified": "2023-05-04T03:49:48.931463Z", "published": "2023-02-14T20:15:00Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q" }, { "type": "FIX", "url": "https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028" }, { "type": "WEB", "url": "https://github.com/pallets/werkzeug/releases/tag/2.2.3" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.