GHSA-p8f7-22gq-m7j9: Phoenix before 1.6.14 mishandles check_origin wildcarding

Affected versions

phoenix Hex

Affected Fixed in

All versions before 1.6.14 1.6.14Advisories →

Affected	Fixed in
All versions before 1.6.14	`1.6.14`Advisories →
Also listed as affected (128) `0.1.0` `0.10.0` `0.11.0` `0.12.0` `0.13.0` `0.13.1` `0.14.0` `0.15.0` `0.16.0` `0.16.1` `0.17.0` `0.17.1` `0.2.0` `0.2.1` `0.2.10` `0.2.11` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `0.2.8` `0.2.9` `0.3.0` `0.3.1` `0.4.0` `0.4.1` `0.5.0` `0.6.0` `0.6.1` `0.6.2` `0.7.0` `0.7.1` `0.7.2` `0.8.0` `0.9.0` `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.1.0` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.1.5` `1.1.6` `1.1.7` `1.1.8` `1.1.9` `1.2.0` `1.2.0-rc.0` `1.2.0-rc.1` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.3.0` `1.3.0-rc.0` `1.3.0-rc.1` `1.3.0-rc.2` `1.3.0-rc.3` `1.3.1` `1.3.2` `1.3.3` `1.3.4` `1.3.5` `1.4.0` `1.4.0-rc.0` `1.4.0-rc.1` `1.4.0-rc.2` `1.4.0-rc.3` `1.4.1` `1.4.10` `1.4.11` `1.4.12` `1.4.13` `1.4.14` `1.4.15` `1.4.16` `1.4.17` `1.4.18` `1.4.2` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.4.9` `1.5.0` `1.5.0-rc.0` `1.5.1` `1.5.10` `1.5.11` `1.5.12` `1.5.13` `1.5.14` `1.5.15` `1.5.2` `1.5.3` `1.5.4` `1.5.5` `1.5.6` `1.5.7` `1.5.8` `1.5.9` `1.6.0` `1.6.0-rc.0` `1.6.0-rc.1` `1.6.1` `1.6.10` `1.6.11` `1.6.12` `1.6.13` `1.6.2` `1.6.3` `1.6.4` `1.6.5` `1.6.6` `1.6.7` `1.6.8` `1.6.9`

Also listed as affected (128)

0.1.0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0
0.15.0
0.16.0
0.16.1
0.17.0
0.17.1
0.2.0
0.2.1
0.2.10
0.2.11
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.8.0
0.9.0
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.0-rc.0
1.2.0-rc.1
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.3.0
1.3.0-rc.0
1.3.0-rc.1
1.3.0-rc.2
1.3.0-rc.3
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.0-rc.0
1.4.0-rc.1
1.4.0-rc.2
1.4.0-rc.3
1.4.1
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.4.15
1.4.16
1.4.17
1.4.18
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.0
1.5.0-rc.0
1.5.1
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.0-rc.0
1.6.0-rc.1
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9

Description

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

GHSA-p8f7-22gq-m7j9

Affected versions

phoenix Hex

Description

References