OESA-2023-1952

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1952

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2023-1952.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2023-1952

Upstream

CVE-2023-26136

Published

2023-12-22T11:06:32Z

Modified

2025-09-03T06:19:02.606445Z

Summary

nodejs-tough-cookie security update

Details

Security Fix(es):

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.(CVE-2023-26136)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / nodejs-tough-cookie

Package

Name: nodejs-tough-cookie
Purl: pkg:rpm/openEuler/nodejs-tough-cookie&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.2-3.oe2003sp4

Ecosystem specific

{
    "noarch": [
        "nodejs-tough-cookie-2.3.2-3.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "nodejs-tough-cookie-2.3.2-3.oe2003sp4.src.rpm"
    ]
}