VDB
RHSA-2023%3A5541
RHSA-2023%3A5541
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:79590fd5063ffa0245d96cec02dc4ce257244a431e213ecbe38462e86536b859_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-view-plugin-rhel8@sha256:79590fd5063ffa0245d96cec02dc4ce257244a431e213ecbe38462e86536b859_arm64, openshift-logging/logging-view-plugin-rhel8@sha256:79590fd5063ffa0245d96cec02dc4ce257244a431e213ecbe38462e86536b859_arm64, openshift-logging/logging-view-plugin-rhel8@sha256:79590fd5063ffa0245d96cec02dc4ce257244a431e213ecbe38462e86536b859_arm64 |
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:fd9b30d940cdc8b281fa4a46e8a22f946571e7e72695fef9cfa02c4337e74dc0_amd64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-view-plugin-rhel8@sha256:fd9b30d940cdc8b281fa4a46e8a22f946571e7e72695fef9cfa02c4337e74dc0_amd64, openshift-logging/logging-view-plugin-rhel8@sha256:fd9b30d940cdc8b281fa4a46e8a22f946571e7e72695fef9cfa02c4337e74dc0_amd64, openshift-logging/logging-view-plugin-rhel8@sha256:fd9b30d940cdc8b281fa4a46e8a22f946571e7e72695fef9cfa02c4337e74dc0_amd64 |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le, openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le, * |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:92ab2dde35f2f59c3a8ce7b8b12f5703a7a214e83ca5cc13673d0c8ad373f02e_amd64 as a component of RHOL 5.6 for RHEL 8 | *, *, * |
| Red Hat | openshift-logging/logging-loki-rhel8@sha256:af7c029f15eacd2b65a99271538c68d9b2dcd5c25dbfabadd0e9f8bb2911d827_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-loki-rhel8@sha256:af7c029f15eacd2b65a99271538c68d9b2dcd5c25dbfabadd0e9f8bb2911d827_s390x, openshift-logging/logging-loki-rhel8@sha256:af7c029f15eacd2b65a99271538c68d9b2dcd5c25dbfabadd0e9f8bb2911d827_s390x, openshift-logging/logging-loki-rhel8@sha256:af7c029f15eacd2b65a99271538c68d9b2dcd5c25dbfabadd0e9f8bb2911d827_s390x |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le, openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le, openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le |
| Red Hat | openshift-logging/logging-loki-rhel8@sha256:aea6196bddef8110c0d9282d6e84a7e8cdee066fab8ba3607dacb8425b458819_ppc64le as a component of RHOL 5.6 for RHEL 8 | *, *, openshift-logging/logging-loki-rhel8@sha256:aea6196bddef8110c0d9282d6e84a7e8cdee066fab8ba3607dacb8425b458819_ppc64le |
| Red Hat | openshift-logging/vector-rhel8@sha256:a9f8b40acd19609ee9c9bc85a4f2cdec9aa4c8c786b62ad94e33c8ea451de961_amd64 as a component of RHOL 5.6 for RHEL 8 | *, openshift-logging/vector-rhel8@sha256:a9f8b40acd19609ee9c9bc85a4f2cdec9aa4c8c786b62ad94e33c8ea451de961_amd64, openshift-logging/vector-rhel8@sha256:a9f8b40acd19609ee9c9bc85a4f2cdec9aa4c8c786b62ad94e33c8ea451de961_amd64 |
| Red Hat | openshift-logging/logging-loki-rhel8@sha256:47df30d450dbc2b26cf828f2208832ddcba75719cef9486d047e4b2bfb2c61a8_amd64 as a component of RHOL 5.6 for RHEL 8 | *, *, openshift-logging/logging-loki-rhel8@sha256:47df30d450dbc2b26cf828f2208832ddcba75719cef9486d047e4b2bfb2c61a8_amd64 |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel8@sha256:a2bd4a83b30b2b9e88e8581784e3e901d564d576ba3a58824cd203779ccc9e80_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/log-file-metric-exporter-rhel8@sha256:a2bd4a83b30b2b9e88e8581784e3e901d564d576ba3a58824cd203779ccc9e80_ppc64le, openshift-logging/log-file-metric-exporter-rhel8@sha256:a2bd4a83b30b2b9e88e8581784e3e901d564d576ba3a58824cd203779ccc9e80_ppc64le, openshift-logging/log-file-metric-exporter-rhel8@sha256:a2bd4a83b30b2b9e88e8581784e3e901d564d576ba3a58824cd203779ccc9e80_ppc64le |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:fc638d1f8ff0f079ea1f5cfa3a9938dc06374ca4e6cd24f92ba62b7d03fd6963_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/eventrouter-rhel8@sha256:fc638d1f8ff0f079ea1f5cfa3a9938dc06374ca4e6cd24f92ba62b7d03fd6963_arm64, openshift-logging/eventrouter-rhel8@sha256:fc638d1f8ff0f079ea1f5cfa3a9938dc06374ca4e6cd24f92ba62b7d03fd6963_arm64, openshift-logging/eventrouter-rhel8@sha256:fc638d1f8ff0f079ea1f5cfa3a9938dc06374ca4e6cd24f92ba62b7d03fd6963_arm64 |
| Red Hat | openshift-logging/logging-curator5-rhel8@sha256:1cac7ceee19cd185658324643c9a81d055d22aa238a28986c76594153c79b422_amd64 as a component of RHOL 5.6 for RHEL 8 | *, *, openshift-logging/logging-curator5-rhel8@sha256:1cac7ceee19cd185658324643c9a81d055d22aa238a28986c76594153c79b422_amd64 |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:ff509532db6b7e2d3a44fac2cf9b63687aa8bfbaab46d7a5f9d58be192475818_amd64 as a component of RHOL 5.6 for RHEL 8 | *, openshift-logging/eventrouter-rhel8@sha256:ff509532db6b7e2d3a44fac2cf9b63687aa8bfbaab46d7a5f9d58be192475818_amd64, openshift-logging/eventrouter-rhel8@sha256:ff509532db6b7e2d3a44fac2cf9b63687aa8bfbaab46d7a5f9d58be192475818_amd64 |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x as a component of RHOL 5.6 for RHEL 8 | *, openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x, openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x |
| Red Hat | openshift-logging/elasticsearch-operator-bundle@sha256:369d45c783651c6e07dfd721fa43025800b263da8e1fdbbc75b296686426e840_amd64 as a component of RHOL 5.6 for RHEL 8 | *, *, openshift-logging/elasticsearch-operator-bundle@sha256:369d45c783651c6e07dfd721fa43025800b263da8e1fdbbc75b296686426e840_amd64 |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x, *, openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:ce5fc5a37453626de4bcb9a05d3849ef7da0722bfc8f0fecfc1f693cf6b5deff_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/elasticsearch-proxy-rhel8@sha256:ce5fc5a37453626de4bcb9a05d3849ef7da0722bfc8f0fecfc1f693cf6b5deff_arm64, openshift-logging/elasticsearch-proxy-rhel8@sha256:ce5fc5a37453626de4bcb9a05d3849ef7da0722bfc8f0fecfc1f693cf6b5deff_arm64, * |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:e489da61d05557fba2718fd3e75b7ba50c51c173f43088334db7f3c993748711_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/fluentd-rhel8@sha256:e489da61d05557fba2718fd3e75b7ba50c51c173f43088334db7f3c993748711_ppc64le, *, openshift-logging/fluentd-rhel8@sha256:e489da61d05557fba2718fd3e75b7ba50c51c173f43088334db7f3c993748711_ppc64le |
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:50230e9829718254fc51d844e0305978b694354bda4b798fb5066ca3c182d323_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-view-plugin-rhel8@sha256:50230e9829718254fc51d844e0305978b694354bda4b798fb5066ca3c182d323_s390x, openshift-logging/logging-view-plugin-rhel8@sha256:50230e9829718254fc51d844e0305978b694354bda4b798fb5066ca3c182d323_s390x, openshift-logging/logging-view-plugin-rhel8@sha256:50230e9829718254fc51d844e0305978b694354bda4b798fb5066ca3c182d323_s390x |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:26f58db9cb18dfe0eb7a3478a7bb86c87efabe32d98dcf74bc34226a09ea6f0e_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/elasticsearch-proxy-rhel8@sha256:26f58db9cb18dfe0eb7a3478a7bb86c87efabe32d98dcf74bc34226a09ea6f0e_ppc64le, openshift-logging/elasticsearch-proxy-rhel8@sha256:26f58db9cb18dfe0eb7a3478a7bb86c87efabe32d98dcf74bc34226a09ea6f0e_ppc64le, * |
…and 106 more
Timeline
- Oct 20, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:5541 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2219310 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2222167 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2228743 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://issues.redhat.com/browse/LOG-4570 advisory
- https://issues.redhat.com/browse/LOG-4579 advisory
- https://issues.redhat.com/browse/LOG-4687 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5541.json advisory
- https://access.redhat.com/security/cve/CVE-2023-26136 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-26136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-26136 advisory
- https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e advisory
- https://github.com/salesforce/tough-cookie/issues/282 advisory
- https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3 advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html advisory
- https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 advisory
…and 23 more