Fix CVE–2023–26136

[debricked]

CVE–2023–26136

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

GitHub

tough-cookie Prototype Pollution vulnerability

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

GitLab Advisory Database (Open Source Edition)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Versions of the package tough-cookie before 4.1.3 is vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    npm/tough-cookie/CVE-2023-26136.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    NVD - CVE-2023-26136
    tough-cookie Prototype Pollution vulnerability · CVE-2023-26136 · GitHub Advisory Database · GitHub
    Prototype Pollution in tough-cookie | CVE-2023-26136 | Snyk
    Prevent prototype pollution in cookie memstore (#283) · salesforce/tough-cookie@12d4747 · GitHub
    Security Risk · Issue #282 · salesforce/tough-cookie · GitHub
    Release 4.1.3 · salesforce/tough-cookie · GitHub
    [SECURITY] [DLA 3488-1] node-tough-cookie security update
    [SECURITY] Fedora 38 Update: yarnpkg-1.22.21-2.fc38 - package-announce - Fedora Mailing-Lists
    [SECURITY] Fedora 39 Update: yarnpkg-1.22.21-2.fc39 - package-announce - Fedora Mailing-Lists
    [SECURITY] Fedora 39 Update: yarnpkg-1.22.21-2.fc39 - package-announce - Fedora Mailing-Lists
    [SECURITY] Fedora 38 Update: yarnpkg-1.22.21-2.fc38 - package-announce - Fedora Mailing-Lists

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE