GHSA-grh8-3p95-f9rr Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

• Maven org.http4s:http4s-client_2.12: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-client_2.13: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-client_3: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-client_2.13: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47 • Maven org.http4s:http4s-client_3: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47

The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to any host whose name merely contains `example.com` (e.g. `evilexample.com`), leaking potentially sensitive cookies to an attacker-chosen host. Impact Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls. Preconditions • Application uses the `CookieJar` client middleware. • Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring. Workarounds • Do not use the `CookieJar` with clients that fetch attacker-influenced URLs • Apply a separate `CookieJar` per trusted origin.