Bug 1918266 (CVE-2020-36049) - CVE-2020-36049 yarnpkg-socket.io-parser: a denial of service (memory consumption) via a large packet because a concatenation approach is used
Summary: CVE-2020-36049 yarnpkg-socket.io-parser: a denial of service (memory consumpt...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-36049
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1918267 1997390
TreeView+ depends on / blocked
 
Reported: 2021-01-20 11:08 UTC by Marian Rehak
Modified: 2021-12-01 19:33 UTC (History)
9 users (show)

Fixed In Version: socket.io-parser 3.4.1
Doc Type: If docs needed, set a value
Doc Text:
An uncontrolled resource consumption vulnerability was found in socket.io-parser. If an attacker crafts a packet with a very large payload length, this can cause the parser to consume an ever-increasing amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-10-28 01:44:23 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2021-01-20 11:08:01 UTC 
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

Reference:

https://github.com/bcaller/kill-engine-io
https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
Comment 1 Mark Cooper 2021-01-27 07:51:43 UTC 
External References:

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056753
Comment 2 Mark Cooper 2021-01-27 07:54:58 UTC 
Similar to CVE-2020-36048, i think this should have an Important impact as it's primary use is to decode packets as part of the socket.io library. So again, results in a remote DoS. 

However again leaving Quay affects as Low, as these look like dev dependencies to me but want to confirm with engineering. 

$ npm list --prod | grep socket
Comment 3 Mark Cooper 2021-01-27 08:23:38 UTC 
Upstream fix: https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
Note You need to log in before you can comment on or make changes to this bug.