CVE Feed

    Dashboard / CVE / CVE-2017-15010

    CVE-2017-15010

    A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

    Published:Sep 5, 2017
    Last Modified:Apr 20, 2025
    EPS:Oct 3, 2017
    EPSS Score:0.08696
    CVSS Score:7.5

    Affected Products

    Vendor
    Redhat
    Product
    Mobile Application Platform
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Salesforce
    Product
    Tough-cookie

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-6841 (CVSS 7.5) — A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limit…
    CVE-2020-1723 (CVSS 6.1) — A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in use…
    CVE-2018-3728 (CVSS 8.8) — hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MA…
    CVE-2017-7554 (CVSS 6.1) — It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker co…
    CVE-2017-7553 (CVSS 6.3) — The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker…
    CVE-2017-7552 (CVSS 9.8) — A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, …
    CVE-2017-1000117 (CVSS 8.8) — A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit …
    CVE-2016-8704 (CVSS 9.8) — An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processi…
    CVE-2016-8705 (CVSS 9.8) — Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing mu…

    References

    http://www.securityfocus.com/bid/101185
    https://access.redhat.com/errata/RHSA-2017:2912
    https://access.redhat.com/errata/RHSA-2017:2913
    https://access.redhat.com/errata/RHSA-2018:1263
    https://access.redhat.com/errata/RHSA-2018:1264
    https://github.com/salesforce/tough-cookie/issues/92
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
    https://nodesecurity.io/advisories/525
    https://snyk.io/vuln/npm:tough-cookie:20170905
    http://www.securityfocus.com/bid/101185
    https://access.redhat.com/errata/RHSA-2017:2912
    https://access.redhat.com/errata/RHSA-2017:2913
    https://access.redhat.com/errata/RHSA-2018:1263
    https://access.redhat.com/errata/RHSA-2018:1264
    https://github.com/salesforce/tough-cookie/issues/92
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
    https://nodesecurity.io/advisories/525
    https://snyk.io/vuln/npm:tough-cookie:20170905

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High