MGASA-2024-0080

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2024-0080.html
Import Source
https://advisories.mageia.org/MGASA-2024-0080.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2024-0080
Related
Published
2024-03-22T00:19:51Z
Modified
2024-03-21T23:10:26Z
Summary
Updated nodejs-tough-cookie packages fix security vulnerability
Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. (CVE-2023-26136)

References
Credits

Affected packages

Mageia:9 / nodejs-tough-cookie

Package

Name
nodejs-tough-cookie
Purl
pkg:rpm/mageia/nodejs-tough-cookie?distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.4-5.1.mga9

Ecosystem specific 

{
    "section": "core"
}