Описание
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
A regular expression denial of service flaw was found in Tough-Cookie. An attacker able to make an application using Touch-Cookie to parse an HTTP header with many semicolons could cause the application to consume an excessive amount of CPU.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Software Collections | nodejs010-nodejs-tough-cookie | Will not fix | ||
| Red Hat Software Collections | rh-nodejs6-nodejs-tough-cookie | Not affected | ||
| Red Hat OpenShift Container Platform 3.2 | nodejs | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat OpenShift Container Platform 3.2 | nodejs-tough-cookie | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat OpenShift Container Platform 3.3 | nodejs | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat OpenShift Container Platform 3.3 | nodejs-tough-cookie | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat OpenShift Enterprise 3.1 | nodejs | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat OpenShift Enterprise 3.1 | nodejs-tough-cookie | Fixed | RHSA-2016:2101 | 27.10.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-nodejs4-nodejs-tough-cookie | Fixed | RHSA-2017:2912 | 18.10.2017 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | rh-nodejs4-nodejs-tough-cookie | Fixed | RHSA-2017:2912 | 18.10.2017 |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
4.3 Medium
CVSS2
Связанные уязвимости
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
ReDoS via long string of semicolons in tough-cookie
5.3 Medium
CVSS3
4.3 Medium
CVSS2