Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

co.fs2:fs2-io_2.12

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    fs2-io skips mTLS client verification

    CVE-2022-31183 · GHSA-2cpx-6pqp-wf35

    Affected
    • Maven co.fs2:fs2-io_2.12 >= 3.1.0, < 3.2.11
    Fixed in
    3.2.11· Vendor fix available
    Issue
    Impact When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in v3.1.0. Patches A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. Workarounds If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection. References - https://github.com/nodejs/node/issues/43994 -…

    Recommended action: Upgrade to 3.2.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →