PT-2018-4631 · Javascript · Tough-Cookie

David Kirchner · Publicado 2018-09-05 · Atualizado 2018-10-31 · CVE-2016-1000232

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions tough-cookie versions prior to 2.3.0

Description The issue is related to a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing, which can result in Denial of Service. This can be exploited via a custom HTTP header passed by the client, specifically when long strings of semicolons exist in the Set-Cookie header.

Recommendations Update to version 2.3.0 or later. As a temporary workaround, consider restricting the use of custom HTTP headers or limiting the length of strings in the Set-Cookie header to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-1333

CWE-20

Identificadores relacionados

CVE-2016-1000232

GHSA-QHV9-728R-6JQG

RHSA-2016:2101

RHSA-2017:2912

Produtos afetados

Tough-Cookie

Referências · 13

• https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 · Correção
• https://github.com/salesforce/tough-cookie · Nota
• https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000232 · Nota
• https://ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232 · Nota
• https://npmjs.com/advisories/130 · Nota
• https://osv.dev/vulnerability/CVE-2016-1000232 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qhv9-728r-6jqg · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2912 · Aviso do Fabricante
• https://github.com/advisories/GHSA-qhv9-728r-6jqg · Nota
• https://access.redhat.com/security/cve/cve-2016-1000232 · Nota
• https://access.redhat.com/errata/RHSA-2016:2101 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000232 · Nota de Segurança