HighGHSA-qv2v-m59f-v5fwCVE-2017-16031
Insecure randomness in socket.io
Published 7 Nov 2018 · Updated 8 Nov 2023
Affected package
socket.ionpm
- Affected
- <0.9.7
- Fixed in
- 0.9.7
Update to the fixed version for your release line, for example:
npm install socket.io@0.9.7Details
Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.
Recommendation
Update to v0.9.7 or later.
Is GHSA-qv2v-m59f-v5fw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected socket.io, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2017-16031
- Linkgithub.com/socketio/socket.io/issues/856
- Linkgithub.com/socketio/socket.io/pull/857
- Linkgithub.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8
- Advisorygithub.com/advisories/GHSA-qv2v-m59f-v5fw
- Packagegithub.com/socketio/socket.io
- Linkwww.npmjs.com/advisories/321
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.