GHSA-gm98-g2wf-7c68: 
PHP vulnerability analysis and mitigation

A cookie handling vulnerability was discovered in amphp/artax versions before 1.0.6 and 2 before 2.0.6. The vulnerability allowed cookies from subdomains (e.g., foo.bar.example.com) to be leaked to parent domains (e.g., foo.bar). Additionally, any site could set cookies for any other site, creating potential security risks (GitHub Advisory).

The vulnerability stemmed from improper cookie domain validation and handling. The issue specifically affected how the application managed cookie domains and their boundaries. The fix implemented stricter cookie handling rules following modern browser implementations, where cookies can only be set on domains higher or equal to the current domain, while preventing setting on public suffixes (Artax Release).

The vulnerability could allow malicious websites to set cookies for other domains and potentially lead to cookie leakage across domain boundaries. This could result in unauthorized access to user sessions or information intended to be restricted to specific subdomains (GitHub Advisory).

The vulnerability was rated as Moderate severity. It could be exploited by manipulating cookie domains and taking advantage of the loose domain validation in the affected versions (GitHub Advisory).

The vulnerability was fixed in versions 1.0.6 and 2.0.6. The fix implemented proper cookie domain validation following modern browser implementations, preventing cookie leakage to wrong origins and restricting cookie acceptance criteria. Users should upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory, Artax Release).