WS-2017-0421 High Severity Vulnerability detected by WhiteSource
mend-bolt-for-github opened this issue · comments
WS-2017-0421 - High Severity Vulnerability
Vulnerable Library - ws-1.1.5.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
path: /tmp/git/mqtt-mm2-gateway/node_modules/ws/package.json
Library home page: https://registry.npmjs.org/ws/-/ws-1.1.5.tgz
Dependency Hierarchy:
- mqtt-1.14.1.tgz (Root Library)
- websocket-stream-3.3.3.tgz
- ❌ ws-1.1.5.tgz (Vulnerable Library)
- websocket-stream-3.3.3.tgz
Vulnerability Details
Affected version of ws (0.2.6--3.3.0) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.
Publish Date: 2017-11-08
URL: WS-2017-0421
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/550/versions
Release Date: 2019-01-24
Fix Resolution: 3.3.1
Step up your Open Source Security Game with WhiteSource here
fixed by using a newer mqtt js version