CVE-2022-31183 : fs2 is a compositional, streaming I/O library for Scala. When establishing a ser

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent. 2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API. 3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Published 2022-08-01 20:15:08

Updated 2022-08-09 19:38:01

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-31183

Typelevel » FS2
Versions from including (>=) 3.1.0 and before (<) 3.2.11
cpe:2.3:a:typelevel:fs2:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-31183

EPSS FAQ

0.27%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-31183

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	3.9	5.2	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2022-31183

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2022-31183

https://github.com/nodejs/node/issues/43994

How to use `new tls.TLSSocket(...)` to establish a secure connection? · Issue #43994 · nodejs/node · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://github.com/typelevel/fs2/commit/659824395826a314e0a4331535dbf1ef8bef8207

First attempt at test for GHSA-2cpx-6pqp-wf35 · typelevel/fs2@6598243 · GitHub
Patch;Third Party Advisory
https://github.com/typelevel/fs2/security/advisories/GHSA-2cpx-6pqp-wf35

mTLS client verification is skipped in Node.js TLS server · Advisory · typelevel/fs2 · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-31183

Products affected by CVE-2022-31183

Exploit prediction scoring system (EPSS) score for CVE-2022-31183

CVSS scores for CVE-2022-31183

CWE ids for CVE-2022-31183

References for CVE-2022-31183