Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tough-cookie | Salesforce | * | 4.1.3 (excluding) |
| EAP 7.4.13 | RedHat | tough-cookie | * |
| Multicluster engine for Kubernetes 2.3 for RHEL 8 | RedHat | multicluster-engine/console-mce-rhel8:v2.3.2-8 | * |
| Multicluster engine for Kubernetes 2.3 for RHEL 8 | RedHat | multicluster-engine/multicluster-engine-console-mce-rhel8:v2.3.2-8 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.8 for RHEL 8 | RedHat | rhacm2/console-rhel8:v2.8.2-6 | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap | * |
| Red Hat Migration Toolkit for Containers 1.8 | RedHat | rhmtc/openshift-migration-ui-rhel8:v1.8.2-2 | * |
| Red Hat OpenShift Container Platform 4.14 | RedHat | openshift4/ose-monitoring-plugin-rhel8:v4.14.0-202310201027.p0.g8757197.assembly.stream | * |
| RHODF-4.14-RHEL-9 | RedHat | odf4/odf-multicluster-console-rhel9:v4.14.13-3 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-multicluster-console-rhel9:v4.15.9-1 | * |
| RHODF-4.16-RHEL-9 | RedHat | odf4/odf-multicluster-console-rhel9:v4.16.5-2 | * |
| RHODF-4.17-RHEL-9 | RedHat | odf4/odf-multicluster-console-rhel9:v4.17.0-53 | * |
| RHOL-5.5-RHEL-8 | RedHat | openshift-logging/logging-view-plugin-rhel8:v5.5.17-6 | * |
| RHOL-5.6-RHEL-8 | RedHat | openshift-logging/logging-view-plugin-rhel8:v5.6.12-8 | * |
| RHOL-5.7-RHEL-8 | RedHat | openshift-logging/logging-view-plugin-rhel8:v5.7.3-6 | * |
| Node-tough-cookie | Ubuntu | bionic | * |
| Node-tough-cookie | Ubuntu | focal | * |
| Node-tough-cookie | Ubuntu | kinetic | * |
| Node-tough-cookie | Ubuntu | lunar | * |
| Node-tough-cookie | Ubuntu | mantic | * |
| Node-tough-cookie | Ubuntu | trusty | * |
| Node-tough-cookie | Ubuntu | upstream | * |
| Node-tough-cookie | Ubuntu | xenial | * |