CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

Score

CVSS 3.1 4.4 Medium

Status

Modified - cve@mitre.org

Published

2019-11-19

Last modified

2024-08-06

Weaknesses

CWE-362

Affected products

• Cookie-signature (Cookie-signature Project)
• Debian Linux (Debian)

References

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618
• https://bugzilla.redhat.com/show_bug.cgi?id=1371409
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236
• https://security-tracker.debian.org/tracker/CVE-2016-1000236
• https://travis-ci.com/nodejs/security-wg/builds/76423102
• https://www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html