Affected versions of tough-cookie
are susceptible to a regular expression denial of service.
The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.
If node was compiled using the -DHTTP_MAX_HEADER_SIZE
however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.
Update to version 2.3.3 or later.
www.securityfocus.com/bid/101185
access.redhat.com/errata/RHSA-2017:2912
access.redhat.com/errata/RHSA-2017:2913
access.redhat.com/errata/RHSA-2018:1263
access.redhat.com/errata/RHSA-2018:1264
github.com/advisories/GHSA-g7q5-pjjr-gqvp
github.com/salesforce/tough-cookie
github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d
github.com/salesforce/tough-cookie/issues/92
lists.fedoraproject.org/archives/list/[email protected]/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT
nvd.nist.gov/vuln/detail/CVE-2017-15010
snyk.io/vuln/npm:tough-cookie:20170905
www.npmjs.com/advisories/525