Quick answers
- Is CVE-2016-1000232 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-1000232 being exploited in the wild.
- How severe is CVE-2016-1000232?
- Low severity, with a CVSS score of 3, published 10 October 2018.
- Which products and versions are affected?
- tough-cookie (npm) SEMVER:introduced=0,fixed=2.3.0.
- Is there a fix for CVE-2016-1000232?
- Yes. tough-cookie (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-1000232 attacked?
- It is attacked over the network.
- Am I affected by CVE-2016-1000232?
- Check whether you run tough-cookie (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- tough-cookie (npm): upgrade to 2.3.0 or later
npm install tough-cookie@2.3.0
Technical details
The vulnerability is a regular expression denial of service (ReDoS) issue in the cookie parsing logic of tough-cookie. When processing Set-Cookie headers containing long strings of semicolons, the vulnerable regular expression exhibits catastrophic backtracking, causing exponential processing time. The attack is network-reachable and requires no authentication—any attacker can craft a malicious HTTP response with a crafted Set-Cookie header. The vulnerability affects all versions prior to 2.3.0. Exploitation results in denial of service through CPU exhaustion. The fix was implemented in version 2.3.0 and later.
Affected products
- Salesforce tough-cookie before 2.3.0
Identifiers
- CVE-2016-1000232
- GHSA-qhv9-728r-6jqg
Timeline
- 2018-10-10: disclosed