Red Hat Security AdvisoryRHSA-2017:2912
rh-nodejs4-nodejs-tough-cookie security update
Released 2017-10-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs4-nodejs-tough-cookie-2.3.3-2.el7
Fixes 2 records
Priority LOW 39
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03283 · Published 2017-10-03 · Fixed in 2.3.3 CWE-400
Priority LOW 29
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02356 · Published 2018-09-05 · Partial fix · 2.3.0 CWE-20
