GHSA-wv64-j4fq-5f9x Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

• Maven org.http4s:http4s-client_2.12: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-client_2.13: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-client_2.13: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47 • Maven org.http4s:http4s-client_3: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47 • Maven org.http4s:http4s-client_3: < 0.23.35 → fixed in 0.23.35

When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies. Impact Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client. Preconditions • Application uses the `CookieJar` client middleware. • Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts. Workarounds • Do not share a `CookieJar` across trusted and untrusted targets. Note This middleware still does not implement public suffix rejection.