Socket.IO-client Java before 2.0.1 vulnerable to NULL Pointer Dereference

2022-08-0300:00:57

Google

osv.dev

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

60.8%

JSON

The package io.socket:socket.io-client before 2.0.1 is vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.

CPENameOperatorVersion
io.socket:socket.io-clienteq1.0.2
io.socket:socket.io-clienteq0.8.3
io.socket:socket.io-clienteq0.8.2
io.socket:socket.io-clienteq0.6.2
io.socket:socket.io-clienteq0.8.0
io.socket:socket.io-clienteq2.0.0
io.socket:socket.io-clienteq0.6.3
io.socket:socket.io-clienteq0.9.0
io.socket:socket.io-clienteq0.6.1
io.socket:socket.io-clienteq1.0.1

Name	Operator	Version
io.socket:socket.io-client	eq	1.0.2
io.socket:socket.io-client	eq	0.8.3
io.socket:socket.io-client	eq	0.8.2
io.socket:socket.io-client	eq	0.6.2
io.socket:socket.io-client	eq	0.8.0
io.socket:socket.io-client	eq	2.0.0
io.socket:socket.io-client	eq	0.6.3
io.socket:socket.io-client	eq	0.9.0
io.socket:socket.io-client	eq	0.6.1
io.socket:socket.io-client	eq	1.0.1