CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
85.8%
Affected versions of tough-cookie
are susceptible to a regular expression denial of service.
The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.
If node was compiled using the -DHTTP_MAX_HEADER_SIZE
however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.
Update to version 2.3.3 or later.
Vendor | Product | Version | CPE |
---|---|---|---|
salesforce | tough-cookie | * | cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:* |
www.securityfocus.com/bid/101185
access.redhat.com/errata/RHSA-2017:2912
access.redhat.com/errata/RHSA-2017:2913
access.redhat.com/errata/RHSA-2018:1263
access.redhat.com/errata/RHSA-2018:1264
github.com/advisories/GHSA-g7q5-pjjr-gqvp
github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d
github.com/salesforce/tough-cookie/issues/92
lists.fedoraproject.org/archives/list/[email protected]/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
nvd.nist.gov/vuln/detail/CVE-2017-15010
snyk.io/vuln/npm:tough-cookie:20170905
www.npmjs.com/advisories/525
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
85.8%