CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-26136 – tough-cookie: prototype pollution in cookie memstore
https://notcve.org/view.php?id=CVE-2023-26136
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. • https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e https://github.com/salesforce/tough-cookie/issues/282 https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3 https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ https://secu • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2017-15010 – nodejs-tough-cookie: Regular expression denial of service
https://notcve.org/view.php?id=CVE-2017-15010
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. Se detectó una vulnerabilidad de denegación de servicio con expresiones regulares (ReDoS) en el módulo tough-cookie en versiones anteriores a la 2.3.3 para Node.js. Un atacante que sea capaz de realizar una petición HTTP utilizando una cookie especialmente manipulada podría hacer que la aplicación consuma una cantidad excesiva de recursos de CPU. A regular expression denial of service flaw was found in Tough-Cookie. • https://github.com/ossf-cve-benchmark/CVE-2017-15010 http://www.securityfocus.com/bid/101185 https://access.redhat.com/errata/RHSA-2017:2912 https://access.redhat.com/errata/RHSA-2017:2913 https://access.redhat.com/errata/RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1264 https://github.com/salesforce/tough-cookie/issues/92 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT https://nodesecurity.io/advisories&# • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2016-1000232 – nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
https://notcve.org/view.php?id=CVE-2016-1000232
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. NodeJS Tough-Cookie 2.2.2 contiene una vulnerabilidad de análisis de expresiones regulares en el análisis de la cabecera de cookie de petición HTTP que puede resultar en una denegación de servicio (DoS). Este ataque parece ser explotable mediante una cabecera HTTP personalizada pasada por el cliente. • https://access.redhat.com/errata/RHSA-2016:2101 https://access.redhat.com/errata/RHSA-2017:2912 https://access.redhat.com/security/cve/cve-2016-1000232 https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232 https://www.npmjs.c • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •