Low · published September 23, 2022
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | < 7.85.0 | 7.85.0 |
| netapp/clustered_data_ontap | all versions | — |
| netapp/element_software | all versions | — |
| netapp/hci_management_node | all versions | — |
| netapp/solidfire | all versions | — |
| netapp/bootstrap_os | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| apple/macos | ≥ 11.0, < 11.7.3 | 11.7.3 |
| apple/macos | ≥ 12.0.0, < 12.6.3 | 12.6.3 |
| debian/debian_linux | all versions | — |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |