Open mend-for-github-com[bot] opened 4 years ago
:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.
:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.
CVE-2016-1000232 - Medium Severity Vulnerability
Vulnerable Library - io.jsv4.6.1
Node.js JavaScript runtime :sparkles::turtle::rocket::sparkles:
Library home page: https://github.com/iojs/io.js.git
Found in HEAD commit: c92f0918f68b35842a2bf5ae212e5d75e70546e5
Found in base branch: gh-pages
Vulnerable Source Files (1)
Vulnerability Details
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Publish Date: 2018-09-05
URL: CVE-2016-1000232
CVSS 3 Score Details (5.3)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/130
Release Date: 2018-09-05
Fix Resolution: 2.3.0