CVE-2016-1000236 cookie-signature Timing Attack
An attacker can exploit a timing attack in the signature comparison to bypass cookie integrity checks in Node.js applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1000236?
CVE-2016-1000236 is a medium-severity vulnerability in Debian Debian Linux, published on 19 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
Weakness: CWE-362
Which versions are affected by CVE-2016-1000236?
2 open source packages ship an affected version, including cookie-signature. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
cookie-signature npm | All versions | 1.0.4 |
cookie-signature npm | All versions | 1.0.4 |
Products include Cookie-Signature Project Cookie-Signature, Debian Debian Linux.
How do I fix CVE-2016-1000236?
Upgrade cookie-signature to 1.0.4 or later.
Is CVE-2016-1000236 being exploited?
There is no known exploitation of CVE-2016-1000236 in the wild and no public exploit code.
Sources
Also known as AZL-44412, CLSA-2026-1773879459, CLSA-2026-1784683082, DEBIAN-CVE-2016-1000236, GHSA-92vm-wfm5-mxvv, UBUNTU-CVE-2016-1000236.