CVE-2016-1000232: Input Validation
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Other sources
Tough-cookie is a cookie parsing and management library.
Versions 0.9.7 through 2.2.2 contain a vulnerable regular expression that, under certain conditions involving long strings of semicolons in the "Cookie" header, causes the event loop to block for excessive amounts of time.
External References:
https://nodesecurity.io/advisories/130
Upstream fixes:
https://github.com/SalesforceEng/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 https://github.com/SalesforceEng/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1000232?
CVE-2016-1000232 is classified as a Denial of Service vulnerability.
How do I fix CVE-2016-1000232?
To fix CVE-2016-1000232, upgrade to Tough-Cookie version 2.3.0 or later.
Which versions of Tough-Cookie are affected by CVE-2016-1000232?
Tough-Cookie versions prior to 2.3.0, specifically version 2.2.2, are affected by CVE-2016-1000232.
Can CVE-2016-1000232 be exploited remotely?
Yes, CVE-2016-1000232 can be exploited via custom HTTP headers passed by a client.
What is the impact of exploiting CVE-2016-1000232?
Exploitation of CVE-2016-1000232 can lead to a Denial of Service, affecting application availability.