CVE-2016-1000232
At a glance
- Source
- NVD
- EPSS
- EPSS 2.36 % · percentile 84 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- https://access.redhat.com/errata/RHSA-2016:2101
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/
- https://access.redhat.com/errata/RHSA-2017:2912
- https://www.npmjs.com/advisories/130
- https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
- https://access.redhat.com/security/cve/cve-2016-1000232
- https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-qhv9-728r-6jqg — ReDoS via long string of semicolons in tough-cookie
European references
- ENISA EUVD · EUVD-2018-0666
- GCVE · GCVE-0-2016-1000232
CERT-FR advisories
- CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:*≥ 0.9.7 ≤ 2.2.2cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*≥ 5.0.6.0 ≤ 5.0.6.5cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*≥ 5.0.7.0 ≤ 5.0.7.2cpe:2.3:a:ibm:api_connect:5.0.8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |