Vulnerability · Published Jul 9, 2020 · Assigned by snyk
CVE-2020-7693Denial of Service (DoS)
Medium 5.3
In plain English
A medium-severity security flaw in sockjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)5.0%top 7.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | sockjs | 0.3.20 | GHSA-c9g6-9335-x697 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-SOCKJS-575261 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575448 x_refsource_MISC
- https://github.com/sockjs/sockjs-node/issues/252 x_refsource_MISC
- https://github.com/sockjs/sockjs-node/pull/265 x_refsource_MISC
- https://github.com/andsnw/sockjs-dos-py x_refsource_MISC
- https://github.com/sockjs/sockjs-node/commit/dd7e642cd69ee74385825816d30642c43e051d16 x_refsource_MISC