CVE-2022-31183: fs2-io skips mTLS client verification
(updated )
When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds.
The vulnerability is limited to:
fs2-iorunning on Node.js. The JVM TLS implementation is completely independent.TLSSockets in server-mode. Client-modeTLSSockets are implemented via a different API.- mTLS as enabled via
requestCert = trueinTLSParameters. The default setting isfalsefor server-modeTLSSockets.
It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.
References
- github.com/advisories/GHSA-2cpx-6pqp-wf35
- github.com/nodejs/node/issues/43994
- github.com/typelevel/fs2
- github.com/typelevel/fs2/commit/19ce392e8093d9571387dbd78e159e655a85aeea
- github.com/typelevel/fs2/commit/659824395826a314e0a4331535dbf1ef8bef8207
- github.com/typelevel/fs2/releases/tag/v3.2.11
- github.com/typelevel/fs2/security/advisories/GHSA-2cpx-6pqp-wf35
- nvd.nist.gov/vuln/detail/CVE-2022-31183
Code Behaviors & Features
Detect and mitigate CVE-2022-31183 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →