Search Issue Tracker
Fixed in 2021.3.35f1, 2022.3.19f1, 2023.2.10f1, 2023.3.0b5, 2024.1.0a1
[Priority_NoRepro] Assessment of CVE-2023-46218
Creating this on behalf of a customer who has asked for an assessment of the following:
>> This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
Reviewing the Curl website, this issue is present in versions up to (and including) 8.4 and has been fixed in 8.5:
Please assign to WebRequest team
Note: No CQA testing was carried out.
All about bugs
View bugs we have successfully reproduced, and vote for the bugs you want to see fixed most urgently.
- [Editor][macOS] macOS icon hover text should include the Unity version
- Crash on BucketAllocator::Allocate when entering Play mode
- [HDRP] Canvas resizes when navigating the hierarchy
- AudioSource Stereo Pan property doesn't fully mute the right or left channel when using a VideoPlayer attached to an AudioSource and setting the option to -1 or 1
- Advertisement Legacy is not initialized when entering the Play Mode for the second time