UBUNTU-CVE-2023-26136: Critical severity ubuntu/node-tough-cookie vulnerability
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/node-tough-cookieto a version that resolves this vulnerability.Fixed in 2.3.2+dfsg-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/node-tough-cookieto a version that resolves this vulnerability.Fixed in 3.0.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/node-tough-cookieto a version that resolves this vulnerability.Fixed in 4.0.0-2ubuntu0.1~esm1 - Upgrade
Upgrade
tough-cookieto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using tough-cookie versions before 4.1.3 are exposed when CookieJar is configured with rejectPublicSuffixes=false. The provided information does not establish exposure for CookieJar instances using the default or any other configuration.
What does an attacker need to exploit the vulnerability?
The issue is network-accessible, requires no privileges, and requires no user interaction according to the supplied severity vector. Exploitation involves improper handling of cookies by CookieJar in rejectPublicSuffixes=false mode.
What should be changed to remediate the issue?
Upgrade tough-cookie to version 4.1.3 or later. If an immediate upgrade is not possible, avoid using CookieJar with rejectPublicSuffixes=false.
How can I determine whether an application is affected?
Check whether the application uses a tough-cookie version earlier than 4.1.3 and whether any CookieJar instance is configured with rejectPublicSuffixes=false. Both conditions are identified in the provided vulnerability information as relevant to exposure.