ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server     component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP     cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and     `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to     forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a     workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to     filter out any unexpected `Cookie` request headers. (CVE-2022-36032)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server
    component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP
    cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and
    `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to
    forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a
    workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to
    filter out any unexpected `Cookie` request headers. (CVE-2022-36032)

ID	Name	Product	Family	Type	Severity
261253	Linux Distros Unpatched Vulnerability : CVE-2022-36032	Nessus	Misc.	Local	medium
419670	SCA: security update for react/http (GHSA-w3w9-vrf5-8mx8)	Tenable Cloud Security	SCA Checks	Local	medium
419670	SCA: security update for react/http (GHSA-w3w9-vrf5-8mx8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2022-36032

medium

Tenable Plugins

medium

medium

medium