Prototype pollution in Tough-cookie - CVE-2023-26136

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU80323

Prototype pollution in Tough-cookie - CVE-2023-26136

Published: September 4, 2023


Vulnerability identifier: #VU80323
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26136
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


Affected software

Tough-cookie
Cloud Pak for Network Automation
DB2 Data Management Console
IBM Cloud Pak for Watson AIOps
Storage Ceph
Business Automation Insights
Qlik Sense Enterprise for Windows
IBM Security QRadar Network Threat Analytics
Storage Defender – Data Protect
IBM Planning Analytics Workspace
Cognos Dashboards on Cloud Pak for Data
DB2 on Cloud Pak for Data
PowerSYSTEM Center
Migration Toolkit for Containers
IBM Edge Application Manager
IBM Cloud Pak for Security
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Logging
IBM Cloud Pak for Business Automation
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Protect Plus
watsonx.data
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
JBoss Enterprise Application Platform
Fedora
openEuler
eap7 (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
yarnpkg
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-undertow (Red Hat package)
nodejs-tough-cookie
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
QRadar Suite
IBM Security QRadar Analyst Workflow
IBM Cloud Pak System
IBM QRadar Data Synchronization App
Event Streams
IBM App Connect Enterprise
IBM Cognos Analytics

How to mitigate CVE-2023-26136

Install update from vendor's website.

Tough-cookie - update to 4.1.3
PowerSYSTEM Center - update to 2020 Update 21
Migration Toolkit for Containers - update to 1.8.2
watsonx.data - update to 2.3.1
Multicluster Engine for Kubernetes - update to 2.3.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.8.2
DB2 Data Management Console - update to 3.1.13.2
OpenShift Logging - addressed in versions 5.5.17, 5.6.12
Storage Ceph - update to 8.1
JBoss Enterprise Application Platform - update to 7.4.13
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
eap7 (Red Hat package) - addressed in versions mod_cluster-1.4.5-1.Final_redhat_00001.1.el7eap, mod_cluster-1.4.5-1.Final_redhat_00001.1.el8eap, mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
Qlik Sense Enterprise for Windows - addressed in versions May 2025 Patch 6, November 2024 Patch 18, May 2024 Patch 24
IBM Security QRadar Network Threat Analytics - update to 1.4.0
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.15-1.Final_redhat_00001.1.el7eap, 1.5.15-1.Final_redhat_00001.1.el8eap, 1.5.15-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-31.Final_redhat_00030.1.el7eap, 1.10.0-31.Final_redhat_00030.1.el8eap, 1.10.0-31.Final_redhat_00030.1.el9eap
QRadar Suite - update to 1.10.26.0
eap7-jboss-modules (Red Hat package) - addressed in versions 1.12.2-1.Final_redhat_00001.1.el7eap, 1.12.2-1.Final_redhat_00001.1.el8eap, 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.20-1.Final_redhat_00001.1.el7eap, 1.15.20-1.Final_redhat_00001.1.el8eap, 1.15.20-1.Final_redhat_00001.1.el9eap
yarnpkg - addressed in versions 1.22.21-2.fc38, 1.22.21-2.fc39, 1.22.22-5.el9
eap7-bouncycastle (Red Hat package) - addressed in versions 1.76.0-4.redhat_00001.1.el7eap, 1.76.0-4.redhat_00001.1.el8eap, 1.76.0-4.redhat_00001.1.el9eap
Storage Defender – Data Protect - update to 2.0
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.13-2.SP1_redhat_00001.1.el7eap, 2.0.13-2.SP1_redhat_00001.1.el8eap, 2.0.13-2.SP1_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
eap7-undertow (Red Hat package) - addressed in versions 2.2.26-1.SP1_redhat_00001.1.el7eap, 2.2.26-1.SP1_redhat_00001.1.el8eap, 2.2.26-1.SP1_redhat_00001.1.el9eap
nodejs-tough-cookie - update to 2.3.2-3
IBM Cloud Pak System - addressed in versions 2.3.3.7 IF001, 2.3.4.0
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-15.redhat_00049.1.el7eap, 2.16.0-15.redhat_00049.1.el8eap, 2.16.0-15.redhat_00049.1.el9eap
IBM Security QRadar Analyst Workflow - update to 2.32.0
IBM QRadar Data Synchronization App - update to 3.2.1
eap7-hal-console (Red Hat package) - addressed in versions 3.3.19-1.Final_redhat_00001.1.el7eap, 3.3.19-1.Final_redhat_00001.1.el8eap, 3.3.19-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.10-1.Final_redhat_00001.1.el7eap, 3.8.10-1.Final_redhat_00001.1.el8eap, 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.8-1.Final_redhat_00001.1.el7eap, 3.15.8-1.Final_redhat_00001.1.el8eap, 3.15.8-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.94-1.Final_redhat_00001.1.el7eap, 4.1.94-1.Final_redhat_00001.1.el8eap, 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.94-1.Final_redhat_00001.1.el7eap, 4.1.94-1.Final_redhat_00001.1.el8eap, 4.1.94-1.Final_redhat_00001.1.el9eap
IBM Decision Optimization for Cloud Pak for Data - update to 4.7.2
Cognos Dashboards on Cloud Pak for Data - update to 4.7.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.4
DB2 on Cloud Pak for Data - update to 4.8.4
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.5, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.12, 10.1.0
eap7-hibernate (Red Hat package) - addressed in versions 5.3.31-1.Final_redhat_00001.1.el7eap, 5.3.31-1.Final_redhat_00001.1.el8eap, 5.3.31-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.13-8.GA_redhat_00001.1.el7eap, 7.4.13-8.GA_redhat_00001.1.el8eap, 7.4.13-8.GA_redhat_00001.1.el9eap
IBM Spectrum Protect Plus - update to 10.1.6.4
IBM App Connect Enterprise - update to 11.0.0.22
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
Event Streams - update to 11.2.2

External References

Related Security Bulletins