CVE-2016-1000232
published 2018-09-05CVE-2016-1000232: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of…
PriorityP427medium5.3CVSS 3.0
AVNACLPRNUINSUCNINAL
EPSS
2.36%
81.8th percentile
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | api_connect | — | — |
| ibm | api_connect | 5.0.6.0 – 5.0.6.5 | — |
| ibm | api_connect | 5.0.7.0 – 5.0.7.2 | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| salesforce | tough-cookie | >= 0 < 2.3.0 | 2.3.0 |
| salesforce | tough-cookie | 0.9.7 – 2.2.2 | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
vendor_redhat·2016-07-22·CVSS 5.3
CVE-2016-1000232 [MEDIUM] CWE-400 nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
A regular expression denial of service flaw was found in Tough-Cookie. An attacker able to make an application using Touch-Cookie to parse an HTTP header with many semicolons could cause the application to consume an excessive amount of CPU.
Package: nodejs010-nodejs-tough-cookie (Red Hat Software Collections) - Will not fix
Package: rh-nodejs6-nodejs-tough-cookie (Red Hat Software Collections) - Not affected
OSV
ReDoS via long string of semicolons in tough-cookie
osv·2018-10-10
CVE-2016-1000232 [MEDIUM] ReDoS via long string of semicolons in tough-cookie
ReDoS via long string of semicolons in tough-cookie
Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.
## Recommendation
Update to version 2.3.0 or later.
GHSA
ReDoS via long string of semicolons in tough-cookie
ghsa·2018-10-10
CVE-2016-1000232 [MEDIUM] CWE-1333 ReDoS via long string of semicolons in tough-cookie
ReDoS via long string of semicolons in tough-cookie
Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.
## Recommendation
Update to version 2.3.0 or later.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-1000232 nodejs-tough-cookie: Denial of service via long string of semicolons [fedora-all]
bugzilla·2016-07-25·CVSS 5.3
CVE-2016-1000232 [MEDIUM] CVE-2016-1000232 nodejs-tough-cookie: Denial of service via long string of semicolons [fedora-all]
CVE-2016-1000232 nodejs-tough-cookie: Denial of service via long string of semicolons [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2016-1000232 nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
bugzilla·2016-07-25·CVSS 5.3
CVE-2016-1000232 [MEDIUM] CVE-2016-1000232 nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
CVE-2016-1000232 nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
Tough-cookie is a cookie parsing and management library.
Versions 0.9.7 through 2.2.2 contain a vulnerable regular expression that, under certain conditions involving long strings of semicolons in the "Cookie" header, causes the event loop to block for excessive amounts of time.
External References:
https://nodesecurity.io/advisories/130
Upstream fixes:
https://github.com/SalesforceEng/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534
https://github.com/SalesforceEng/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
Discussion:
Created nodejs-tough-cookie tracking bugs for this issue:
Affects: fedora-all [bug 1359819]
---
nodejs-tough-cookie-2.3.1-1.fc24 has
https://access.redhat.com/errata/RHSA-2016:2101https://access.redhat.com/errata/RHSA-2017:2912https://access.redhat.com/security/cve/cve-2016-1000232https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235aehttps://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/https://www.npmjs.com/advisories/130https://access.redhat.com/errata/RHSA-2016:2101https://access.redhat.com/errata/RHSA-2017:2912https://access.redhat.com/security/cve/cve-2016-1000232https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235aehttps://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/https://www.npmjs.com/advisories/130
2018-09-05
Published