Skip to content
OpenAdvisories
High RHSA-2017:2912 2 CVEs

Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-nodejs4-nodejs-tough-cookie 0:2.3.3-2.el6
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-nodejs4-nodejs-tough-cookie 0:2.3.3-2.el7

Vulnerabilities 2

  • High 7.5
    CVE-2017-15010

    Regular Expression Denial of Service in tough-cookie

    A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CP…

    tough-cookie node-tough-cookie node-tough-cookie Debian Ubuntu npm
  • Medium 5.3
    CVE-2016-1000232

    ReDoS via long string of semicolons in tough-cookie

    NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …

    tough-cookie npm

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1359818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1493989
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2912.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-1000232
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1000232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1000232
  • article
    https://nodesecurity.io/advisories/130
  • report
    https://access.redhat.com/security/cve/CVE-2017-15010
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15010
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15010
  • article
    https://nodesecurity.io/advisories/525