Bug 2293192 (CVE-2024-38355)

Summary:	CVE-2024-38355 socket.io: Unhandled 'error' event
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bdettelb, caswilli, chazlett, gmalinko, hkataria, janstey, jcantril, jsamir, kaycoth, kshier, pdelbell, periklis, pjindal, rstepani, sthirugn, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	socket.io 2.5.1, socket.io 4.6.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Socket.IO package. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, killing the Node.js process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2293886, 2293888, 2293890, 2293891, 2293892, 2293893, 2293887
Bug Blocks:

Description Avinash Hanwate 2024-06-20 05:57:48 UTC

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj

Comment 1 Avinash Hanwate 2024-06-24 06:40:32 UTC

Created magicmirror tracking bugs for this issue:

Affects: fedora-all [bug 2293886]


Created python-socketio tracking bugs for this issue:

Affects: fedora-all [bug 2293887]


Created qt6-qtwebengine tracking bugs for this issue:

Affects: fedora-all [bug 2293888]