{"id":"CVE-2017-18589","aliases":["RUSTSEC-2017-0005"],"url":"https://o3.security/vulnerability/CVE-2017-18589","summary":"Improper Input Validation in cookie","details":"Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.\n\nThis flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.","published":"2021-08-25T20:43:02Z","modified":"2023-11-08T03:59:16.406669Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"cookie","fixedVersion":"0.7.6"}],"fix":{"url":"https://github.com/SergioBenitez/cookie-rs/pull/86","label":"SergioBenitez/cookie-rs#86"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18589"},{"type":"WEB","url":"https://github.com/SergioBenitez/cookie-rs/pull/86"},{"type":"WEB","url":"https://github.com/SergioBenitez/cookie-rs/commit/ee18b79fbf0903b73da525d302b09448009e0050"},{"type":"PACKAGE","url":"https://github.com/alexcrichton/cookie-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2017-0005.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T03:59:16.406669Z"}}