react/http-v0.8.7: 1 vulnerabilities (highest severity is: 5.3)

[mend-for-github-com]

Vulnerable Library - react/http-v0.8.7

Event-driven, streaming plaintext HTTP and secure HTTPS server for ReactPHP

Library home page: https://api.github.com/repos/reactphp/http/zipball/9aa446fd86745403a09c315c90d4e464fd84382b

Found in HEAD commit: 4e5656db54be4b22481fe3774c2caeba51bac190

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (react/http-v0.8.7 version)	Remediation Possible**	Reachability
CVE-2022-36032	Medium	5.3	Not Defined	0.1%	react/http-v0.8.7	Direct	1.7.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-36032

Vulnerable Library - react/http-v0.8.7

Event-driven, streaming plaintext HTTP and secure HTTPS server for ReactPHP

Library home page: https://api.github.com/repos/reactphp/http/zipball/9aa446fd86745403a09c315c90d4e464fd84382b

Dependency Hierarchy:

• ❌ react/http-v0.8.7 (Vulnerable Library)

Found in HEAD commit: 4e5656db54be4b22481fe3774c2caeba51bac190

Found in base branch: main

Vulnerability Details

ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host- and __Secure- confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected Cookie request headers.

Publish Date: 2022-09-06

URL: CVE-2022-36032

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w3w9-vrf5-8mx8

Release Date: 2022-09-06

Fix Resolution: 1.7.0