← All advisories

Moderate severityNVD Advisory· Published Nov 19, 2019· Updated Aug 6, 2024

CVE-2016-1000236

CVE-2016-1000236

Description

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
cookie-signaturenpm	< 1.0.4	1.0.4

Affected products

2

node-cookie-signature/cookie-signaturedescription
ghsa-coords
pkg:npm/cookie-signature
Range: < 1.0.4

Patches

Vulnerability mechanics

References

13

github.com/advisories/GHSA-92vm-wfm5-mxvvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-1000236ghsaADVISORY
bugs.debian.org/cgi-bin/bugreport.cgighsax_refsource_MISCWEB
bugzilla.redhat.com/show_bug.cgighsax_refsource_MISCWEB
bugzilla.redhat.com/show_bug.cgighsax_refsource_MISCWEB
github.com/tj/node-cookie-signature/commit/2c4df6b6cee540f30876198cd0b5bebf28528c07ghsaWEB
github.com/tj/node-cookie-signature/commit/39791081692e9e14aa62855369e1c7f80fbfd50eghsaWEB
github.com/tj/node-cookie-signature/commit/4cc5e21e7f59a4ea0b51cd5e9634772d48fab590ghsaWEB
security-tracker.debian.org/tracker/CVE-2016-1000236ghsax_refsource_MISCWEB
travis-ci.com/nodejs/security-wg/builds/76423102ghsax_refsource_MISCWEB
www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.htmlmitrex_refsource_MISC
www.mail-archive.com/secure-testing-team@lists.alioth.debian.org/msg06583.htmlghsaWEB
www.npmjs.com/advisories/134ghsaWEB

News mentions

0

No linked articles in our index yet.