CVE-2016-1000236

Опубликовано: 19 нояб. 2019

Источник: nvd

CVSS3: 4.4

CVSS2: 3.5

EPSS Низкий

Описание

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

Ссылки

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618
Issue Tracking
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1371409
Issue Tracking
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236
Issue Tracking
Patch
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2016-1000236
Patch
Third Party Advisory
https://travis-ci.com/nodejs/security-wg/builds/76423102
Third Party Advisory
https://www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618
Issue Tracking
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1371409
Issue Tracking
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236
Issue Tracking
Patch
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2016-1000236
Patch
Third Party Advisory
https://travis-ci.com/nodejs/security-wg/builds/76423102
Third Party Advisory
https://www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cookie-signature_project:cookie-signature:*:*:*:*:*:node.js:*:*

Версия до 1.0.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00539

Низкий

4.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-362

Связанные уязвимости

CVE-2016-1000236

CVSS3: 4.4

ubuntu

около 6 лет назад

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

CVE-2016-1000236

CVSS3: 5.4

redhat

больше 11 лет назад

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

CVE-2016-1000236

CVSS3: 4.4

debian

около 6 лет назад

Node-cookie-signature before 1.0.6 is affected by a timing attack due ...

GHSA-92vm-wfm5-mxvv

CVSS3: 4.4

github

около 6 лет назад

cookie-signature Timing Attack

EPSS

Процентиль: 67%

0.00539

Низкий

4.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-362