GitHub Advisoryadvisory · npm
GHSA-qhv9-728r-6jqg ReDoS via long string of semicolons in tough-cookie
MEDIUM
Official page ↗
- Aliases
- CVE-2016-1000232
- Ecosystem
- npm
- Packages
- tough-cookie
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1333
- Reviewed
- 2020-06-16
Affected packages
• npm tough-cookie: < 2.3.0 → fixed in 2.3.0
Description
Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.
Recommendation
Update to version 2.3.0 or later.
Related
Alias · CVE (1)
- CVE-2016-1000232 NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000232 advisory
- https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae web
- https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 web
- https://access.redhat.com/errata/RHSA-2016:2101 web
- https://access.redhat.com/errata/RHSA-2017:2912 web
- https://access.redhat.com/security/cve/cve-2016-1000232 web
- https://github.com/advisories/GHSA-qhv9-728r-6jqg advisory
- https://github.com/salesforce/tough-cookie package
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232 web
- https://www.npmjs.com/advisories/130 web