Description
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a tough-cookie
0 to < 4.1.3affected
References
- https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 ↗
- https://github.com/salesforce/tough-cookie/issues/282 ↗
- https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e ↗
- https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3 ↗
- https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/ ↗
- https://security.netapp.com/advisory/ntap-20240621-0006/ ↗