WS-2016-0018 (High) detected in engine.io-client-1.5.4.tgz

[mend-bolt-for-github]

WS-2016-0018 - High Severity Vulnerability

Vulnerable Library - engine.io-client-1.5.4.tgz

Client for the realtime Engine

Library home page: https://registry.npmjs.org/engine.io-client/-/engine.io-client-1.5.4.tgz

Path to dependency file: /PitchDeck/plugin/multiplex/package.json

Path to vulnerable library: /tmp/git/PitchDeck/plugin/multiplex/node_modules/engine.io-client/package.json

Dependency Hierarchy:

• socket.io-1.3.7.tgz (Root Library)
  • socket.io-client-1.3.7.tgz
    • ❌ engine.io-client-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: c4b4153557cc59a4ee7b9cedf5d38ad01ff91b2d

Vulnerability Details

Engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, certificate verification will be disabled.

Publish Date: 2016-04-26

URL: WS-2016-0018

CVSS 2 Score Details (7.3)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: socketio/engine.io-client@2c55b27

Release Date: 2016-03-30

Fix Resolution: Replace or update the following file: socket.js

---

Step up your Open Source Security Game with WhiteSource here