| Package | Affected versions | Patched versions |
|---|---|---|
| co.fs2:fs2-io | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| co.fs2:fs2-io_2.12 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| co.fs2:fs2-io_2.13 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| co.fs2:fs2-io_3 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| co.fs2:fs2-io_sjs1_2.13 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| co.fs2:fs2-io_sjs1_3 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
| fs2 | ≥ 3.1.0, < 3.2.11 | 3.2.11 |
When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds.
The vulnerability is limited to:
fs2-io running on Node.js. The JVM TLS implementation is completely independent.TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API.requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets.It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.
A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised.
If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free