CVE-2023-32695 - OpenCVE

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Socket	Socket.io-parser

Configuration 1 [-]

OR	cpe:2.3:a:socket:socket.io-parser::::::node.js::*
	cpe:2.3:a:socket:socket.io-parser::::::node.js::*

No data.

References

Link	Providers
https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-05-27T15:44:03.235Z

Updated: 2024-08-02T15:25:36.835Z

Reserved: 2023-05-11T16:33:45.733Z

Link: CVE-2023-32695

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-05-27T16:15:09.433

Modified: 2023-06-05T15:54:48.487

Link: CVE-2023-32695

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32695", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-11T16:33:45.733Z", "datePublished": "2023-05-27T15:44:03.235Z", "dateUpdated": "2024-08-02T15:25:36.835Z"}, "containers": {"cna": {"title": "Insufficient validation when decoding a Socket.IO packet", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"}, {"name": "https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced"}, {"name": "https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"}, {"name": "https://github.com/socketio/socket.io-parser/releases/tag/4.2.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io-parser/releases/tag/4.2.3"}], "affected": [{"vendor": "socketio", "product": "socket.io-parser", "versions": [{"version": ">= 4.0.0, < 4.2.3", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-27T15:44:03.235Z"}, "descriptions": [{"lang": "en", "value": "socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n"}], "source": {"advisory": "GHSA-cqmj-92xf-r6r9", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:25:36.835Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"}, {"name": "https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced"}, {"name": "https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"}, {"name": "https://github.com/socketio/socket.io-parser/releases/tag/4.2.3", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/socketio/socket.io-parser/releases/tag/4.2.3"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1DC31C5F-524B-478D-A85F-0D4F4DCCFF28", "versionEndExcluding": "3.4.3", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "994E08C3-8408-4FA3-AA7A-A2C13CD20AC9", "versionEndExcluding": "4.2.3", "versionStartIncluding": "4.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n"}], "id": "CVE-2023-32695", "lastModified": "2023-06-05T15:54:48.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-05-27T16:15:09.433", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/socketio/socket.io-parser/releases/tag/4.2.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}