CVE-2020-36049 - Denial of Service Vulnerability

Abstract

socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

The socket.io-parser package is vulnerable to Denial of Service (DoS). The decodeString() function in index.js fails to parse large remote strings passed into the application for decoding due to unnecessary memory allocation leading to Uncontrolled Resource Consumption. A remote attacker with control over the input string being decoded by the library may craft a malicious string that would cause an application using the socker.io-parser package to crash.

The Oxygen Content Fusion product incorporates the socket.io-parser as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

Syncro Soft recommands users of Content Fusion 3.0 or older to upgrade to Oxygen Content Fusion 4.0.

Detail

CVE-2020-36049

Severity: High

CVSS Score: 7.5

The socket.io-parser package third-party library used by Oxygen Content Fusion software product is an affected version mentioned in CVE-2020-36049 vulnerability description.

Starting with Oxygen Content Fusion 4.0, we have limited the maximum size of a package to 1MB.

Therefore, the Oxygen Content Fusion product is not impacted by CVE-2020-36049.