CVE-2022-25901 : Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Express

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

Published 2023-01-18 05:15:12

Updated 2023-01-25 18:21:10

Source Snyk

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-25901

Cookiejar Project » Cookiejar » For Node.js
Versions up to, including, (<=) 2.1.3
cpe:2.3:a:cookiejar_project:cookiejar:*:*:*:*:*:node.js:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-25901

EPSS FAQ

0.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-25901

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	Snyk
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2022-25901

CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-25901

https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73

Page not found · GitHub · GitHub
Broken Link
https://github.com/bmeck/node-cookiejar/pull/39

fix: add a guard against maliciously-sized cookies by andyburke · Pull Request #39 · bmeck/node-cookiejar · GitHub
Patch;Third Party Advisory
https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5

fix: add a guard against maliciously-sized cookies by andyburke · Pull Request #39 · bmeck/node-cookiejar · GitHub
Patch;Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681

Regular Expression Denial of Service (ReDoS) in org.webjars.npm:cookiejar | CVE-2022-25901 | Snyk
Exploit;Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984

Regular Expression Denial of Service (ReDoS) in cookiejar | CVE-2022-25901 | Snyk
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-25901

Products affected by CVE-2022-25901

Exploit prediction scoring system (EPSS) score for CVE-2022-25901

CVSS scores for CVE-2022-25901

CWE ids for CVE-2022-25901

References for CVE-2022-25901