HIGH7.5

GHSA-p8f7-22gq-m7j9

Phoenix before 1.6.14 mishandles check_origin wildcarding

Quick fix

GHSA-p8f7-22gq-m7j9 — phoenix: upgrade to the fixed version with the command below.

mix deps.update phoenix

Details

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Are you affected?

Enter the version of the package you're using.

Affected packages

Hex/phoenix

Introduced in: 0Fixed in: 1.6.14

Fixmix deps.update phoenix

References

https://nvd.nist.gov/vuln/detail/CVE-2022-42975[ADVISORY]
https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae[WEB]
https://github.com/phoenixframework/phoenix[PACKAGE]
https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10[WEB]