GitHub Advisoryadvisory · npm

GHSA-4r4m-hjwj-43p8 Insecure Defaults Allow MITM Over TLS in engine.io-client

MEDIUM Published 2019-02-18 Modified 2023-09-07 Official page ↗
Aliases
CVE-2016-10536
Ecosystem
npm
Packages
engine.io-client
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-300
Reviewed
2020-06-16

Affected packages

• npm engine.io-client: < 1.6.9 → fixed in 1.6.9

Description

Affected versions of `engine.io-client` do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled. Recommendation Update to version 1.6.9 or later. If you are unable to upgrade, ensure all calls to socket.io to have a `rejectedUnauthorized: true` flag.

Related

Alias · CVE (1)

  • CVE-2016-10536 engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional… vulnerability

Weakness · CWE (1)

  • CWE-300 Channel Accessible by Non-Endpoint weakness

References