5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.011 Low
EPSS
Percentile
84.8%
Affected versions of tough-cookie
are susceptible to a regular expression denial of service.
The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.
If node was compiled using the -DHTTP_MAX_HEADER_SIZE
however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.
Update to version 2.3.3 or later.
CPE | Name | Operator | Version |
---|---|---|---|
tough-cookie | lt | 2.3.3 |
www.securityfocus.com/bid/101185
access.redhat.com/errata/RHSA-2017:2912
access.redhat.com/errata/RHSA-2017:2913
access.redhat.com/errata/RHSA-2018:1263
access.redhat.com/errata/RHSA-2018:1264
github.com/advisories/GHSA-g7q5-pjjr-gqvp
github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d
github.com/salesforce/tough-cookie/issues/92
lists.fedoraproject.org/archives/list/[email protected]/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
nvd.nist.gov/vuln/detail/CVE-2017-15010
snyk.io/vuln/npm:tough-cookie:20170905
www.npmjs.com/advisories/525
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.011 Low
EPSS
Percentile
84.8%