CVE-2022-25901

🗓️ 18 Jan 2023 05:00:01Reported by snykType

Versions of the package cookiejar before 2.1.4 are vulnerable to ReDoS via Cookie.parse function

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	26 Mar 202503:38	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2023	1 Apr 202314:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	24 Feb 202319:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data	25 Jul 202312:06	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	30 May 202318:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to Node.js cookiejar module ( CVE-2022-25901 )	8 Aug 202418:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	10 Oct 202313:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	7 Mar 202309:18	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.10 addresses multiple security vulnerabilities.	27 Sep 202321:11	–	ibm

NVD

Node

cookiejar_project cookiejarRange≤2.1.3node.js

[
  {
    "product": "cookiejar",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.1.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "org.webjars.npm:cookiejar",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
security	www.security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681
github	www.github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5
github	www.github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00008.html
github	www.github.com/bmeck/node-cookiejar/pull/39

13 Feb 2025 17:15Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.3 - 7.5

EPSS0.00074

SSVC

CWE-1333