CVE-2016-10536 (Medium) detected in engine.io-client-1.5.4.tgz

[mend-bolt-for-github]

CVE-2016-10536 - Medium Severity Vulnerability

Vulnerable Library - engine.io-client-1.5.4.tgz

Client for the realtime Engine

Library home page: https://registry.npmjs.org/engine.io-client/-/engine.io-client-1.5.4.tgz

Path to dependency file: /PitchDeck/plugin/multiplex/package.json

Path to vulnerable library: /tmp/git/PitchDeck/plugin/multiplex/node_modules/engine.io-client/package.json

Dependency Hierarchy:

• socket.io-1.3.7.tgz (Root Library)
  • socket.io-client-1.3.7.tgz
    • ❌ engine.io-client-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: c4b4153557cc59a4ee7b9cedf5d38ad01ff91b2d

Vulnerability Details

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as null, resulting in certificate verification being turned off.

Publish Date: 2018-05-31

URL: CVE-2016-10536

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/99

Release Date: 2016-04-26

Fix Resolution: Update to version 1.6.9 or later.

If you are unable to upgrade, ensure all calls to socket.io to have a rejectedUnauthorized: true flag.

---

Step up your Open Source Security Game with WhiteSource here