CVE-2020-36049 - Denial of Service Vulnerability
Severity: Medium2021-03-09
Abstract
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
The socket.io-parser package is vulnerable to Denial of Service (DoS). The decodeString() function in index.js fails to parse large remote strings passed into the application for decoding due to unnecessary memory allocation leading to Uncontrolled Resource Consumption. A remote attacker with control over the input string being decoded by the library may craft a malicious string that would cause an application using the socker.io-parser package to crash.
The Oxygen Content Fusion product incorporates the socket.io-parser as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.
Affected Products/Versions
| Product | Severity | Fixed Release Availability |
| Oxygen Content Fusion 3.0 and older | Medium | Oxygen Content Fusion 4.0 |
Mitigation
Syncro Soft recommands users of Content Fusion 3.0 or older to upgrade to Oxygen Content Fusion 4.0.
Detail
CVE-2020-36049
Severity: High
CVSS Score: 7.5
The socket.io-parser package third-party library used by Oxygen Content Fusion software product is an affected version mentioned in CVE-2020-36049 vulnerability description.
Starting with Oxygen Content Fusion 4.0, we have limited the maximum size of a package to 1MB.
Therefore, the Oxygen Content Fusion product is not impacted by CVE-2020-36049.
