From 743b7ca03eeb20f5d2763cc9dc412abcc6d939f7 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 15 May 2024 17:53:08 +0000
Subject: [PATCH] Publish Advisories

GHSA-8v5x-6vv5-jv4g
GHSA-gm98-g2wf-7c68
---
 .../GHSA-8v5x-6vv5-jv4g.json                  | 66 ++++++++++++++
 .../GHSA-gm98-g2wf-7c68.json                  | 85 +++++++++++++++++++
 2 files changed, 151 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-8v5x-6vv5-jv4g/GHSA-8v5x-6vv5-jv4g.json
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-gm98-g2wf-7c68/GHSA-gm98-g2wf-7c68.json

diff --git a/advisories/github-reviewed/2024/05/GHSA-8v5x-6vv5-jv4g/GHSA-8v5x-6vv5-jv4g.json b/advisories/github-reviewed/2024/05/GHSA-8v5x-6vv5-jv4g/GHSA-8v5x-6vv5-jv4g.json
new file mode 100644
index 00000000000..2422da2706b
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-8v5x-6vv5-jv4g/GHSA-8v5x-6vv5-jv4g.json
@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8v5x-6vv5-jv4g",
+  "modified": "2024-05-15T17:52:41Z",
+  "published": "2024-05-15T17:52:41Z",
+  "aliases": [
+
+  ],
+  "summary": "amphp/http Host Header Injection vulnerability",
+  "details": "amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "amphp/http"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/http/pull/4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/http/commit/16e465fa82555104d1cff98cb8e412295a380214"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/2018-03-15.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/amphp/http"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/http/releases/tag/v1.0.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T17:52:41Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/05/GHSA-gm98-g2wf-7c68/GHSA-gm98-g2wf-7c68.json b/advisories/github-reviewed/2024/05/GHSA-gm98-g2wf-7c68/GHSA-gm98-g2wf-7c68.json
new file mode 100644
index 00000000000..4b66f55636d
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-gm98-g2wf-7c68/GHSA-gm98-g2wf-7c68.json
@@ -0,0 +1,85 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gm98-g2wf-7c68",
+  "modified": "2024-05-15T17:52:00Z",
+  "published": "2024-05-15T17:52:00Z",
+  "aliases": [
+
+  ],
+  "summary": "amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance",
+  "details": "In artax version before 1.0.6 and 2 before 2.0.6, cookies of `foo.bar.example.com` were leaked to `foo.bar`. Additionally, any site could set cookies for any other site. \nArtax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, but not on any public suffixes.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "amphp/artax"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2"
+            },
+            {
+              "fixed": "2.0.6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "amphp/artax"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/artax/commit/25668b891d2bced567bd69611c7d18b6a93d5fc4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/artax/commit/accdadaf78f7a43305c3a97d6a964bbc550a555d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/2017-05-09.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/amphp/artax"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/amphp/artax/releases/tag/v2.0.6"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T17:52:00Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file