Threats tagged 'ghsa-chc2-vx2q-cwqf'

The http.cookiejar.CookieJar component improperly deleted stored cookies when receiving a response with an already expired Set-Cookie header. This deletion occurred without consulting the cookie policy, allowing a server to potentially delete cookies from other domains within a shared cookie jar, such as urllib's HTTPCookieProcessor. The issue was fixed by ensuring the cookie policy is checked before allowing an expired cookie to delete an existing one, in compliance with RFC 6265 section 5.3.