SealSecurityAssignment

SealSecurityAssignment Researching on the vulnrability CVE-2023-26136 Research on Vulnerability: CVE-2023-26136 Description: Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=fal...

tough-cookie-2.5.0-cve-2023-26136-fix

CVE-2023-26136 tough-cookie 2.5.0向け修正 ミッション概要 このプロジェクトは、tough-cookie 4.1.3 以前のバージョンに存在する重大なプロトタイプ汚染（prototype pollution）脆弱性である CVE-2023-26136 に対処するものです。この脆弱性は、クッキー処理に [email protected] を使用している Penguin Software Inc. のWebアプリケーションに影響を及ぼします。 脆弱性の説明 CVE-2023-26136 は、CookieJar を...

Open-Source-Seal-Security

SEAL SECURITY PROJECT : オープンソースエンジニアタスク クリティカルな脆弱性CVE-2023-26136を修正するため、tough-cookie V2.5.0の新しいバージョンを作成（Node.js V20で記述） tough-cookieパッケージのバージョン4.1.3未満は、CookieJarをrejectPublicSuffixes=falseモードで使用する際のCookieの不適切な処理により、プロトタイプ汚染に対して脆弱です。この問題は、オブジェクトが初期化される方法に起因します。...

CVE-2023-26136

CVE-2023-26136 脆弱性に関する調査 説明 tough-cookie パッケージのバージョン 4.1.3 より前のバージョンは、rejectPublicSuffixes=false モードで CookieJar を使用する際の Cookie の不適切な処理により、プロトタイプ汚染に対して脆弱です。この問題は、オブジェクトの初期化方法に起因します。 目的と修正 このプロジェクトは、[email protected] のパッチ適用版を提供し、CVE-2023-26136 の脆弱性を排除しつつ、後方互換性を確保することを目的としています。...

Tough-Cookie-v2.5.0-Patched

Tough-Cookie v2.5.0 补丁 - 原型污染修复 概述 本仓库包含 tough-cookie 包 2.5.0 版本的补丁版本，以解决关键的 原型污染 漏洞（CVE-2023-26136）。该漏洞允许攻击者通过向 JavaScript 对象注入属性来操纵原型链。这可能导致意外行为、安全风险（如远程代码执行）以及依赖该包的应用程序中的兼容性问题。 漏洞描述 在 tough-cookie 包的 v4.1.3 之前的版本中，当使用 CookieJar 并设置 rejectPublicSuffixes=false 模式时，容易受到 原型污染 的攻击。该漏洞源于对 Cookie...

K000162729: NPM tough-cookie vulnerability CVE-2023-26136

Security Advisory Description Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. CVE-2023-26136...

Prototype Pollution

tough-cookie is vulnerable to Prototype Pollution. The vulnerability exists due to improper domain sanitization when using the CookieJar with rejectPublicSuffixes=false which allows an attacker to modify the base prototype, resulting in Prototype Pollution...

CVE-2023-26136

A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

tough-cookie Prototype Pollution vulnerability

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

AZL-43684 CVE-2023-26136 affecting package js-jquery 3.5.0-4

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

CVE-2023-26136

CVE-2023-26136 affects tough-cookie prior to 4.1.3. The issue is a Prototype Pollution vulnerability in CookieJar handling when rejectPublicSuffixes=false, arising from how objects are initialized. Impacted component: tough-cookie (node.js library). Reported root cause: improper object initializa...

CVE-2023-26136: Improperly Controlled Modification of Object Prototype Attributes

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...