NodeJS/yar/0.1.0


Cookie jar plugin for Hapi

https://www.npmjs.com/package/yar
BSD

2 Security Vulnerabilities

Denial of Service in yar

Published date: 2020-09-01T15:15:36Z
CVE: CVE-2014-4179
Links:

Versions of yar prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.

When an invalid encryped session cookie value is provided, the process will crash.

Recommendation

Update to version 2.2.0 or later.

Affected versions: ["0.0.1", "0.0.2", "0.0.3", "0.0.4", "0.0.5", "0.1.0", "0.1.1", "0.1.2", "0.1.3", "0.2.0", "0.3.0", "0.3.1", "0.4.0", "0.4.1", "1.0.0", "1.1.0", "2.0.0", "2.1.0"]
Secure versions: [2.2.0, 2.3.1, 2.3.2, 2.4.0, 3.0.0-rc1, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 4.0.0, 4.1.0, 4.2.0, 5.0.0, 5.0.1, 6.0.0, 7.0.0, 7.0.1, 7.0.2, 8.0.0, 8.1.0, 8.1.1, 8.1.2, 9.0.0, 9.0.1, 9.0.2, 9.1.0]
Recommendation: Update to version 9.1.0.

Denial of Service

Published date: 2014-06-16
CVEs: ["CVE-2014-4179"]
CVSS Score: 7.5
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Coordinating vendor: ^Lift Security
Links:

Yar uses an encrypted cookie for session support, during the hapi request/reply flow if this cookie value is invalid (changed by the end-user), a request object variable is not set. In versions prior 2.2.0, the presence of this variable was not validated prior to use, resulting in an unhandled ReferenceError, which in most cases will crash the process.

Affected versions: ["0.0.1", "0.0.2", "0.0.3", "0.0.4", "0.0.5", "0.1.0", "0.1.1", "0.1.2", "0.1.3", "0.2.0", "0.3.0", "0.3.1", "0.4.0", "0.4.1", "1.0.0", "1.1.0", "2.0.0", "2.1.0"]
Secure versions: [2.2.0, 2.3.1, 2.3.2, 2.4.0, 3.0.0-rc1, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 4.0.0, 4.1.0, 4.2.0, 5.0.0, 5.0.1, 6.0.0, 7.0.0, 7.0.1, 7.0.2, 8.0.0, 8.1.0, 8.1.1, 8.1.2, 9.0.0, 9.0.1, 9.0.2, 9.1.0]
Recommendation: Update to a version 2.2.0 or greater.

45 Other Versions

Version License Security Released
9.1.0 BSD-3-Clause 2018-11-03 - 21:58 over 5 years
9.0.2 BSD-3-Clause 2018-09-24 - 00:21 over 5 years
9.0.1 BSD-3-Clause 2017-12-05 - 18:54 over 6 years
9.0.0 BSD-3-Clause 2017-12-05 - 16:13 over 6 years
8.1.2 BSD-3-Clause 2016-12-19 - 03:35 over 7 years
8.1.1 BSD-3-Clause 2016-11-23 - 16:34 over 7 years
8.1.0 BSD-3-Clause 2016-10-22 - 02:12 over 7 years
8.0.0 BSD-3-Clause 2016-09-07 - 23:13 over 7 years
7.0.2 BSD-3-Clause 2016-05-06 - 13:00 almost 8 years
7.0.1 BSD-3-Clause 2016-05-06 - 12:49 almost 8 years
7.0.0 BSD-3-Clause 2016-02-03 - 16:35 about 8 years
6.0.0 BSD-3-Clause 2016-01-05 - 15:38 about 8 years
5.0.1 BSD-3-Clause 2015-12-22 - 14:54 over 8 years
5.0.0 BSD-3-Clause 2015-11-04 - 03:55 over 8 years
4.2.0 BSD-3-Clause 2015-09-09 - 19:05 over 8 years
4.1.0 BSD-3-Clause 2015-09-09 - 18:33 over 8 years
4.0.0 BSD-3-Clause 2015-09-09 - 18:25 over 8 years
3.0.4 BSD 2015-09-09 - 15:31 over 8 years
3.0.3 BSD 2014-12-11 - 15:52 over 9 years
3.0.2 BSD 2014-12-10 - 23:58 over 9 years
3.0.1 BSD 2014-12-10 - 22:39 over 9 years
3.0.0 BSD 2014-12-10 - 22:35 over 9 years
3.0.0-rc1 BSD 2014-11-28 - 08:45 over 9 years
2.4.0 BSD 2014-07-16 - 11:35 over 9 years
2.3.2 BSD 2014-06-30 - 23:49 over 9 years
2.3.1 BSD 2014-06-30 - 23:37 over 9 years
2.2.0 BSD 2014-06-10 - 23:27 almost 10 years
2.1.0 BSD 2 2014-04-09 - 05:22 almost 10 years
2.0.0 BSD 2 2014-03-20 - 08:50 about 10 years
1.1.0 BSD 2 2014-01-24 - 00:08 about 10 years
1.0.0 BSD 2 2014-01-09 - 08:13 about 10 years
0.4.1 BSD 2 2013-12-11 - 18:02 over 10 years
0.4.0 BSD 2 2013-10-10 - 06:42 over 10 years
0.3.1 BSD 2 2013-07-13 - 17:57 over 10 years
0.3.0 BSD 2 2013-04-30 - 20:00 almost 11 years
0.2.0 BSD 2 2013-04-03 - 07:49 almost 11 years
0.1.3 BSD 2 2013-03-20 - 01:53 about 11 years
0.1.2 BSD 2 2013-03-07 - 20:00 about 11 years
0.1.1 BSD 2 2013-03-06 - 00:14 about 11 years
0.1.0 BSD 2 2013-03-04 - 22:40 about 11 years
0.0.5 BSD 2 2013-02-28 - 19:57 about 11 years
0.0.4 BSD 2 2013-02-20 - 07:42 about 11 years
0.0.3 BSD 2 2013-02-18 - 18:23 about 11 years
0.0.2 BSD 2 2013-02-17 - 17:51 about 11 years
0.0.1 BSD 2 2013-02-15 - 07:31 about 11 years