PT-2017-13815 · Node.Js · Tough-Cookie

Published 2017-10-03 · Updated 2019-06-12 · CVE-2017-15010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tough-cookie versions prior to 2.3.3

Description A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module for Node.js. An attacker can make an HTTP request using a specially crafted cookie to cause the application to consume an excessive amount of CPU. The amplification of this issue is relatively low, taking around 2 seconds to execute on a malicious input of 50,000 characters. However, if Node.js was compiled with the -DHTTP MAX HEADER SIZE flag, the impact can be significant due to the default max HTTP header length limitation in Node.js.

Recommendations Update to version 2.3.3 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-15010

GHSA-G7Q5-PJJR-GQVP

RHSA-2017:2912

RHSA-2017:2913

RHSA-2018:1263

Affected Products

Tough-Cookie

References · 23

• https://github.com/salesforce/tough-cookie/issues/92 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2913 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15010 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1263 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15010 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2912 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7q5-pjjr-gqvp · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15010 · Vendor Advisory
• https://snyk.io/vuln/npm:tough-cookie:20170905 · Patch
• https://cve.org/CVERecord?id=CVE-2017-15010 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15010 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT · Vendor Advisory