Lucene search

K

GoogleOSV:GHSA-QV2V-M59F-V5FW

HistoryNov 07, 2018 - 12:29 a.m.

Insecure randomness in socket.io

2018-11-0700:29:37

Google

osv.dev

5

0.002 Low

EPSS

Percentile

55.3%

Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.

Recommendation

Update to v0.9.7 or later.

CPENameOperatorVersion
socket.iolt0.9.7

References

github.com/advisories/GHSA-qv2v-m59f-v5fw

github.com/socketio/socket.io

github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8

github.com/socketio/socket.io/issues/856

github.com/socketio/socket.io/pull/857

nvd.nist.gov/vuln/detail/CVE-2017-16031

www.npmjs.com/advisories/321

0.002 Low

EPSS

Percentile

55.3%

Related for OSV:GHSA-QV2V-M59F-V5FW

cve1 osv1 nodejs1 cvelist1 github1 prion1 nvd1