Skip to content
This repository has been archived by the owner on Jul 13, 2021. It is now read-only.
This repository has been archived by the owner on Jul 13, 2021. It is now read-only.

CVE-2020-7662 (High) detected in websocket-extensions-0.1.1.tgz #76

Open
@mend-bolt-for-github

Description

CVE-2020-7662 - High Severity Vulnerability

Vulnerable Library - websocket-extensions-0.1.1.tgz

Generic extension manager for WebSocket connections

Library home page: https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.1.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/firebase/node_modules/faye-websocket/node_modules/websocket-driver/node_modules/websocket-extensions/package.json

Dependency Hierarchy:

  • firebase-3.0.5.tgz (Root Library)
    • faye-websocket-0.9.3.tgz
      • websocket-driver-0.6.4.tgz
        • websocket-extensions-0.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 5d3d794322294bffde619a024f9ee9847c275c57

Vulnerability Details

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Publish Date: 2020-06-02

URL: CVE-2020-7662

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g78m-2chm-r7qv

Release Date: 2020-06-02

Fix Resolution: websocket-extensions - 0.1.4


Step up your Open Source Security Game with WhiteSource here

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security vulnerabilitySecurity vulnerability detected by WhiteSource

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions