CVE-2017-15010
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-15010
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15010.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-15010
- Aliases
- Related
- Published
- 2017-10-04T01:29:03Z
- Modified
- 2024-09-18T02:45:23.534269Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.
- References
-
- http://www.securityfocus.com/bid/101185
- https://access.redhat.com/errata/RHSA-2017:2912
- https://access.redhat.com/errata/RHSA-2017:2913
- https://access.redhat.com/errata/RHSA-2018:1263
- https://access.redhat.com/errata/RHSA-2018:1264
- https://github.com/salesforce/tough-cookie/issues/92
- https://nodesecurity.io/advisories/525
- https://snyk.io/vuln/npm:tough-cookie:20170905
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
- https://security-tracker.debian.org/tracker/CVE-2017-15010
Affected packages
Debian:11 / node-tough-cookie
Package
- Name
- node-tough-cookie
- Purl
- pkg:deb/debian/node-tough-cookie?arch=source
Debian:12 / node-tough-cookie
Package
- Name
- node-tough-cookie
- Purl
- pkg:deb/debian/node-tough-cookie?arch=source
Debian:13 / node-tough-cookie
Package
- Name
- node-tough-cookie
- Purl
- pkg:deb/debian/node-tough-cookie?arch=source