Summary
It was discovered that tough-cookie incorrectly handled cookies when the
rejectPublicSuffixes option was disabled, leading to prototype pollution.
An attacker could possibly use this issue to modify the behavior of
applications using tough-cookie, resulting in a denial of service, or
another unspecified impact.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-tough-cookie | 2.3.2+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-tough-cookie | 3.0.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | node-tough-cookie | 4.0.0-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 6.5CVE-2023-26136 Public exploit
tough-cookie Prototype Pollution vulnerability
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
References
-
report
https://ubuntu.com/security/CVE-2023-26136