Update dependency socket.io to ^2.3.0 [SECURITY] (master)

[renovatebot-confluentinc]

For any questions/concerns about this PR, please review the Renovate Bot wiki/FAQs, or the #renovatebot Slack channel.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
socket.io	^4.8.1 → ^2.3.0

---

CORS misconfiguration in socket.io

CVE-2020-28481 / GHSA-fxwf-4rqh-v8g3

More information

Details

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28481
• https://github.com/socketio/socket.io/issues/3671
• https://github.com/socketio/socket.io/commit/f78a575f66ab693c3ea96ea88429ddb1a44c86c7
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
• https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
• https://github.com/advisories/GHSA-fxwf-4rqh-v8g3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

socket.io has an unhandled 'error' event

CVE-2024-38355 / GHSA-25hc-qcg6-38wj

More information

Details

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
    throw err; // Unhandled 'error' event
    ^

Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
    at new NodeError (node:internal/errors:405:5)
    at Socket.emit (node:events:500:17)
    at /myapp/node_modules/socket.io/lib/socket.js:531:14
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
  code: 'ERR_UNHANDLED_ERROR',
  context: undefined
}

Affected versions

Version range	Needs minor update?
4.6.2...latest	Nothing to do
3.0.0...4.6.1	Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0	Please upgrade to socket.io@2.5.1

Patches

This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: socketio/socket.io@d30630b

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

• socketio/socket.io@15af22f
• socketio/socket.io@d30630b

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
• https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
• https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
• https://nvd.nist.gov/vuln/detail/CVE-2024-38355
• https://github.com/advisories/GHSA-25hc-qcg6-38wj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[renovatebot-confluentinc]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: webserver/package-lock.json

File name: webserver-avro/package-lock.json

[semaphore-agent-reader]

Could not automerge PR: Version change not allowed. See your service.yml and default values.