Description
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AmauriC tarteaucitron.js
Default version status: unaffected
0 to < 1.37.0affected
pkg:github/AmauriC/tarteaucitron.jsReferences
- https://github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56 ↗
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0 ↗
- https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169-L2175 ↗
- https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-redos-via-unescaped-cookie-name-in-cookie-purge ↗