Bug 1493989 (CVE-2017-15010)

Summary: CVE-2017-15010 nodejs-tough-cookie: Regular expression denial of service
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, bdettelb, bleanhar, ccoleman, dedgar, dffrench, dmcphers, drusso, hhorak, jgoulding, jkeck, jmadigan, jokerman, jorton, jshepherd, kpiwko, lgriffin, mchappel, ngough, nodejs-sig, pbraun, piotr1212, pwright, rrajasek, tomckay, trepel, zsvetlik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tough-cookie 2.3.3 Doc Type: If docs needed, set a value
Doc Text:
A regular expression denial of service flaw was found in Tough-Cookie. An attacker able to make an application using Touch-Cookie to parse a sufficiently large HTTP request Cookie header could cause the application to consume an excessive amount of CPU.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:25:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1493991, 1497695, 1497696, 1497700, 1497701, 1566717, 1598163    
Bug Blocks: 1493992    
Attachments:
Description Flags
patch none

Description Andrej Nemec 2017-09-21 09:43:32 UTC 
It was found that the tough-cookie module is vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.

Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb so the impact of the ReDoS is limited to around 7.3 seconds of blocking.

Upstream issue:

https://github.com/salesforce/tough-cookie/issues/92

Upstream patch:
https://github.com/salesforce/tough-cookie/commit/98e0916d7b017669c93855d831c6e0b19c14141e
Comment 1 Andrej Nemec 2017-09-21 09:44:23 UTC 
Created nodejs-tough-cookie tracking bugs for this issue:

Affects: fedora-all [bug 1493991]
Comment 4 Pedro Yóssis Silva Barbosa 2017-10-02 13:51:02 UTC 
Created attachment 1333247 [details]
patch
Comment 7 Pedro Yóssis Silva Barbosa 2017-10-08 16:20:45 UTC 
External References:

https://nodesecurity.io/advisories/525
Comment 8 errata-xmlrpc 2017-10-18 16:47:38 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:2912 https://access.redhat.com/errata/RHSA-2017:2912
Comment 9 errata-xmlrpc 2017-10-18 16:58:30 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:2913 https://access.redhat.com/errata/RHSA-2017:2913
Comment 10 Jason Shepherd 2018-01-11 08:03:15 UTC 
RHMAP is vulnerable though use of Request NodeJS library. Need to upgrade to at least 2.83.0
Comment 13 errata-xmlrpc 2018-04-30 15:29:40 UTC 
This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.6

Via RHSA-2018:1264 https://access.redhat.com/errata/RHSA-2018:1264
Comment 14 errata-xmlrpc 2018-04-30 18:40:49 UTC 
This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.6

Via RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1263
Comment 15 Jason Shepherd 2018-06-13 21:29:08 UTC 
NodeJS is shipped in Openshift Enterprise 3.9 as ImageStreams. Those ImageStreams are the RH Software Collection images. Setting Openshift Enterprise 3 as not affected.
Comment 18 Jason Shepherd 2021-03-28 22:20:41 UTC 
Statement:

Red Hat Quay include nodejs-tough-cookie as a build time dependency of protractor. It's no included in the runtime code, and is therefore not affected by this vulnerability.