Skip to content

Commit 8e1c69e

Browse files
petermetzpetermetz
committed
fix(cmd-api-server): upgrade socket.io - CVE-2022-21676
Upgrade the version of socket.io to 4.4.1 which contains the patches for the CVE mentioned in the title. Fixes #1914 Signed-off-by: Peter Somogyvari <[email protected]>
1 parent c7ef800 commit 8e1c69e

File tree

16 files changed

+79
-57
lines changed

16 files changed

+79
-57
lines changed

‎examples/cactus-check-connection-ethereum-validator/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@
1515
},
1616
"dependencies": {
1717
"@types/node": "15.14.7",
18-
"socket.io": "4.1.3"
18+
"socket.io": "4.4.1"
1919
}
2020
}

‎examples/discounted-cartrade/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"log4js": "6.4.0",
2828
"morgan": "1.9.1",
2929
"shelljs": "0.8.5",
30-
"socket.io": "4.1.3",
30+
"socket.io": "4.4.1",
3131
"ts-node": "8.9.1",
3232
"web3": "1.7.0",
3333
"xmlhttprequest": "1.8.0"
@@ -42,4 +42,4 @@
4242
"tslint": "6.0.0",
4343
"typescript": "3.9.10"
4444
}
45-
}
45+
}

‎examples/electricity-trade/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
"log4js": "6.4.0",
2424
"morgan": "1.9.1",
2525
"shelljs": "0.8.5",
26-
"socket.io": "4.1.3",
26+
"socket.io": "4.4.1",
2727
"ts-node": "8.9.1",
2828
"web3": "1.7.0",
2929
"xmlhttprequest": "1.8.0"
@@ -38,4 +38,4 @@
3838
"tslint": "6.0.0",
3939
"typescript": "3.9.10"
4040
}
41-
}
41+
}

‎examples/electricity-trade/tools/transferNumericAsset/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515
"ethereumjs-tx": "2.1.2",
1616
"ts-node": "9.1.1",
1717
"web3": "1.7.0",
18-
"socket.io": "4.1.3"
18+
"socket.io": "4.4.1"
1919
},
2020
"devDependencies": {
2121
"typescript": "3.9.10"
2222
}
23-
}
23+
}

‎examples/test-run-transaction/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"log4js": "6.4.0",
2828
"morgan": "1.9.1",
2929
"shelljs": "0.8.5",
30-
"socket.io": "4.1.3",
30+
"socket.io": "4.4.1",
3131
"ts-node": "8.9.1",
3232
"web3": "1.7.0",
3333
"xmlhttprequest": "1.8.0"

‎extensions/cactus-plugin-htlc-coordinator-besu/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@
7575
"@hyperledger/cactus-plugin-keychain-memory": "1.0.0-rc.3",
7676
"@hyperledger/cactus-test-tooling": "1.0.0-rc.3",
7777
"@types/express": "4.17.8",
78-
"socket.io": "4.1.3"
78+
"socket.io": "4.4.1"
7979
},
8080
"engines": {
8181
"node": ">=10",
@@ -93,4 +93,4 @@
9393
]
9494
}
9595
}
96-
}
96+
}

‎packages/cactus-cmd-api-server/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,8 @@
8484
"run-time-error": "1.4.0",
8585
"rxjs": "7.3.0",
8686
"semver": "7.3.5",
87-
"socket.io": "4.1.3",
88-
"socket.io-client": "4.1.3",
87+
"socket.io": "4.4.1",
88+
"socket.io-client": "4.4.1",
8989
"typescript-optional": "2.0.1",
9090
"uuid": "8.3.2"
9191
},

‎packages/cactus-cmd-api-server/src/main/typescript/api-client/api-server-api-client.ts

+5
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ export class ApiServerApiClient extends DefaultApi {
100100
socket.auth = { token };
101101
this.options.baseOptions = { headers: { Authorization: token } };
102102
log.debug("Received fresh token from token provider OK");
103+
104+
// After upgrading to SocketIO 4.4.1 the automatic reconnection became
105+
// flaky in this test so we are giving it a nudge in here manually to
106+
// do the right thing and reconnect after the token has been updated.
107+
socket.connect();
103108
} else {
104109
socket.disconnect();
105110
subject.error(err);

‎packages/cactus-cmd-socketio-server/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
"jsrsasign": "10.5.0",
3030
"log4js": "6.4.1",
3131
"shelljs": "0.8.5",
32-
"socket.io": "4.1.3",
32+
"socket.io": "4.4.1",
3333
"socket.io-client": "4.1.3",
3434
"web3": "1.6.0",
3535
"xmlhttprequest": "1.8.0"
@@ -42,4 +42,4 @@
4242
"@types/shelljs": "^0.8.11",
4343
"ts-node": "8.9.1"
4444
}
45-
}
45+
}

‎packages/cactus-core-api/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@
106106
"@types/express": "4.17.13",
107107
"make-dir-cli": "3.0.0",
108108
"rxjs": "7.3.0",
109-
"socket.io": "4.1.3",
109+
"socket.io": "4.4.1",
110110
"typescript-optional": "2.0.1"
111111
},
112112
"engines": {
@@ -125,4 +125,4 @@
125125
]
126126
}
127127
}
128-
}
128+
}

‎packages/cactus-plugin-ledger-connector-besu/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@
7575
"@hyperledger/cactus-plugin-keychain-memory": "1.0.0-rc.3",
7676
"@hyperledger/cactus-test-tooling": "1.0.0-rc.3",
7777
"@types/express": "4.17.13",
78-
"socket.io": "4.1.3",
78+
"socket.io": "4.4.1",
7979
"web3-core": "1.5.2",
8080
"web3-eth": "1.5.2"
8181
},
@@ -95,4 +95,4 @@
9595
]
9696
}
9797
}
98-
}
98+
}

‎packages/cactus-plugin-ledger-connector-fabric-socketio/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@
2727
"log4js": "6.4.1",
2828
"serve-favicon": "2.4.5",
2929
"shelljs": "0.8.5",
30-
"socket.io": "4.1.3"
30+
"socket.io": "4.4.1"
3131
},
3232
"devDependencies": {
3333
"@types/config": "0.0.41",
3434
"ts-node": "9.1.1"
3535
}
36-
}
36+
}

‎packages/cactus-plugin-ledger-connector-go-ethereum-socketio/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@
2424
"log4js": "6.4.1",
2525
"serve-favicon": "2.4.5",
2626
"shelljs": "0.8.5",
27-
"socket.io": "4.1.3",
27+
"socket.io": "4.4.1",
2828
"web3": "0.20.7"
2929
},
3030
"devDependencies": {
3131
"@types/config": "0.0.41"
3232
}
33-
}
33+
}

‎packages/cactus-plugin-ledger-connector-sawtooth-socketio/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@
2424
"log4js": "6.4.1",
2525
"serve-favicon": "2.4.5",
2626
"shelljs": "0.8.5",
27-
"socket.io": "4.1.3",
27+
"socket.io": "4.4.1",
2828
"xmlhttprequest": "1.8.0"
2929
},
3030
"devDependencies": {
3131
"@types/config": "0.0.41"
3232
}
33-
}
33+
}

‎packages/cactus-plugin-odap-hermes/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
"axios": "0.21.4",
4343
"crypto-js": "4.0.0",
4444
"secp256k1": "4.0.2",
45-
"socket.io": "4.1.3",
45+
"socket.io": "4.4.1",
4646
"typescript-optional": "2.0.1",
4747
"web3": "1.5.2",
4848
"web3-utils": "1.5.2"
@@ -79,4 +79,4 @@
7979
"runOnChangeOnly": true
8080
}
8181
}
82-
}
82+
}

‎yarn.lock

+48-31
Original file line numberDiff line numberDiff line change
@@ -3935,6 +3935,11 @@
39353935
resolved "https://registry.yarnpkg.com/@socket.io/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz#568d9beae00b0d835f4f8c53fd55714986492e61"
39363936
integrity sha512-dOlCBKnDw4iShaIsH/bxujKTM18+2TOAsYz+KSc11Am38H4q5Xw8Bbz97ZYdrVNM+um3p7w86Bvvmcn9q+5+eQ==
39373937

3938+
"@socket.io/component-emitter@~3.0.0":
3939+
version "3.0.0"
3940+
resolved "https://registry.yarnpkg.com/@socket.io/component-emitter/-/component-emitter-3.0.0.tgz#8863915676f837d9dad7b76f50cb500c1e9422e9"
3941+
integrity sha512-2pTGuibAXJswAPJjaKisthqS/NOK5ypG4LYT6tEAV0S/mxW0zOIvYvGK0V8w8+SHxAm6vRMSjqSalFXeBAqs+Q==
3942+
39383943
"@solidity-parser/parser@^0.11.0":
39393944
version "0.11.1"
39403945
resolved "https://registry.yarnpkg.com/@solidity-parser/parser/-/parser-0.11.1.tgz#fa840af64840c930f24a9c82c08d4a092a068add"
@@ -4130,7 +4135,7 @@
41304135
dependencies:
41314136
"@types/express" "*"
41324137

4133-
"@types/cookie@^0.4.0", "@types/cookie@^0.4.1":
4138+
"@types/cookie@^0.4.1":
41344139
version "0.4.1"
41354140
resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.4.1.tgz#bfd02c1f2224567676c1545199f87c3a861d878d"
41364141
integrity sha512-XW/Aa8APYr6jSVVA1y/DEIZX0/GMKLEVekNG727R8cs56ahETkRAy/3DR7+fJyh7oUgGwNQaRfXCun0+KbWY7Q==
@@ -4140,7 +4145,7 @@
41404145
resolved "https://registry.yarnpkg.com/@types/cordova/-/cordova-0.0.34.tgz#ea7addf74ecec3d7629827a0c39e2c9addc73d04"
41414146
integrity sha1-6nrd907Ow9dimCegw54smt3HPQQ=
41424147

4143-
"@types/[email protected]", "@types/cors@^2.8.10", "@types/cors@^2.8.12":
4148+
"@types/[email protected]", "@types/cors@^2.8.12":
41444149
version "2.8.12"
41454150
resolved "https://registry.yarnpkg.com/@types/cors/-/cors-2.8.12.tgz#6b2c510a7ad7039e98e7b8d3d6598f4359e5c080"
41464151
integrity sha512-vt+kDhq/M2ayberEtJcIN/hxXy1Pk+59g2FV/ZQceeaTyCtCucjL2Q7FXlFjtWn4n15KCr1NE2lNNFhp0lEThw==
@@ -9482,6 +9487,21 @@ engine.io-client@~5.1.2:
94829487
ws "~7.4.2"
94839488
yeast "0.1.2"
94849489

9490+
engine.io-client@~6.1.1:
9491+
version "6.1.1"
9492+
resolved "https://registry.yarnpkg.com/engine.io-client/-/engine.io-client-6.1.1.tgz#800d4b9db5487d169686729e5bd887afa78d36b0"
9493+
integrity sha512-V05mmDo4gjimYW+FGujoGmmmxRaDsrVr7AXA3ZIfa04MWM1jOfZfUwou0oNqhNwy/votUDvGDt4JA4QF4e0b4g==
9494+
dependencies:
9495+
"@socket.io/component-emitter" "~3.0.0"
9496+
debug "~4.3.1"
9497+
engine.io-parser "~5.0.0"
9498+
has-cors "1.1.0"
9499+
parseqs "0.0.6"
9500+
parseuri "0.0.6"
9501+
ws "~8.2.3"
9502+
xmlhttprequest-ssl "~2.0.0"
9503+
yeast "0.1.2"
9504+
94859505
engine.io-parser@~2.2.0:
94869506
version "2.2.1"
94879507
resolved "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-2.2.1.tgz#57ce5611d9370ee94f99641b589f94c97e4f5da7"
@@ -9493,33 +9513,20 @@ engine.io-parser@~2.2.0:
94939513
blob "0.0.5"
94949514
has-binary2 "~1.0.2"
94959515

9496-
engine.io-parser@~4.0.0, engine.io-parser@~4.0.1:
9516+
engine.io-parser@~4.0.1:
94979517
version "4.0.3"
94989518
resolved "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-4.0.3.tgz#83d3a17acfd4226f19e721bb22a1ee8f7662d2f6"
94999519
integrity sha512-xEAAY0msNnESNPc00e19y5heTPX4y/TJ36gr8t1voOaNmTojP9b3oK3BbJLFufW2XFPQaaijpFewm2g2Um3uqA==
95009520
dependencies:
95019521
base64-arraybuffer "0.1.4"
95029522

9503-
engine.io-parser@~5.0.3:
9523+
engine.io-parser@~5.0.0, engine.io-parser@~5.0.3:
95049524
version "5.0.3"
95059525
resolved "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-5.0.3.tgz#ca1f0d7b11e290b4bfda251803baea765ed89c09"
95069526
integrity sha512-BtQxwF27XUNnSafQLvDi0dQ8s3i6VgzSoQMJacpIcGNrlUdfHSKbgm3jmjCVvQluGzqwujQMPAoMai3oYSTurg==
95079527
dependencies:
95089528
"@socket.io/base64-arraybuffer" "~1.0.2"
95099529

9510-
engine.io@~5.1.1:
9511-
version "5.1.1"
9512-
resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-5.1.1.tgz#a1f97e51ddf10cbd4db8b5ff4b165aad3760cdd3"
9513-
integrity sha512-aMWot7H5aC8L4/T8qMYbLdvKlZOdJTH54FxfdFunTGvhMx1BHkJOntWArsVfgAZVwAO9LC2sryPWRcEeUzCe5w==
9514-
dependencies:
9515-
accepts "~1.3.4"
9516-
base64id "2.0.0"
9517-
cookie "~0.4.1"
9518-
cors "~2.8.5"
9519-
debug "~4.3.1"
9520-
engine.io-parser "~4.0.0"
9521-
ws "~7.4.2"
9522-
95239530
engine.io@~6.1.0:
95249531
version "6.1.3"
95259532
resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.1.3.tgz#f156293d011d99a3df5691ac29d63737c3302e6f"
@@ -20554,7 +20561,7 @@ snapdragon@^0.8.1:
2055420561
source-map-resolve "^0.5.0"
2055520562
use "^3.1.0"
2055620563

20557-
socket.io-adapter@~2.3.1, socket.io-adapter@~2.3.3:
20564+
socket.io-adapter@~2.3.3:
2055820565
version "2.3.3"
2055920566
resolved "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-2.3.3.tgz#4d6111e4d42e9f7646e365b4f578269821f13486"
2056020567
integrity sha512-Qd/iwn3VskrpNO60BeRyCyr8ZWw9CPZyitW4AQwmRZ8zCiyDiL+znRnWX6tDHXnWn1sJrM1+b6Mn6wEDJJ4aYQ==
@@ -20572,6 +20579,18 @@ [email protected]:
2057220579
parseuri "0.0.6"
2057320580
socket.io-parser "~4.0.4"
2057420581

20582+
[email protected]:
20583+
version "4.4.1"
20584+
resolved "https://registry.yarnpkg.com/socket.io-client/-/socket.io-client-4.4.1.tgz#b6aa9448149d09b8d0b2bbf3d2fac310631fdec9"
20585+
integrity sha512-N5C/L5fLNha5Ojd7Yeb/puKcPWWcoB/A09fEjjNsg91EDVr5twk/OEyO6VT9dlLSUNY85NpW6KBhVMvaLKQ3vQ==
20586+
dependencies:
20587+
"@socket.io/component-emitter" "~3.0.0"
20588+
backo2 "~1.0.2"
20589+
debug "~4.3.2"
20590+
engine.io-client "~6.1.1"
20591+
parseuri "0.0.6"
20592+
socket.io-parser "~4.1.1"
20593+
2057520594
socket.io-client@^2.1.0:
2057620595
version "2.4.0"
2057720596
resolved "https://registry.yarnpkg.com/socket.io-client/-/socket.io-client-2.4.0.tgz#aafb5d594a3c55a34355562fc8aea22ed9119a35"
@@ -20607,22 +20626,15 @@ socket.io-parser@~4.0.4:
2060720626
component-emitter "~1.3.0"
2060820627
debug "~4.3.1"
2060920628

20610-
socket.io@4.1.3:
20611-
version "4.1.3"
20612-
resolved "https://registry.yarnpkg.com/socket.io/-/socket.io-4.1.3.tgz#d114328ef27ab31b889611792959c3fa6d502500"
20613-
integrity sha512-tLkaY13RcO4nIRh1K2hT5iuotfTaIQw7cVIe0FUykN3SuQi0cm7ALxuyT5/CtDswOMWUzMGTibxYNx/gU7In+Q==
20629+
socket.io-parser@~4.1.1:
20630+
version "4.1.2"
20631+
resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.1.2.tgz#0a97d4fb8e67022158a568450a6e41887e42035e"
20632+
integrity sha512-j3kk71QLJuyQ/hh5F/L2t1goqzdTL0gvDzuhTuNSwihfuFUrcSji0qFZmJJPtG6Rmug153eOPsUizeirf1IIog==
2061420633
dependencies:
20615-
"@types/cookie" "^0.4.0"
20616-
"@types/cors" "^2.8.10"
20617-
"@types/node" ">=10.0.0"
20618-
accepts "~1.3.4"
20619-
base64id "~2.0.0"
20634+
"@socket.io/component-emitter" "~3.0.0"
2062020635
debug "~4.3.1"
20621-
engine.io "~5.1.1"
20622-
socket.io-adapter "~2.3.1"
20623-
socket.io-parser "~4.0.4"
2062420636

20625-
socket.io@^4.2.0:
20637+
socket.io@4.4.1, socket.io@^4.2.0:
2062620638
version "4.4.1"
2062720639
resolved "https://registry.yarnpkg.com/socket.io/-/socket.io-4.4.1.tgz#cd6de29e277a161d176832bb24f64ee045c56ab8"
2062820640
integrity sha512-s04vrBswdQBUmuWJuuNTmXUVJhP0cVky8bBDhdkf8y0Ptsu7fKU2LuLbts9g+pdmAdyMMn8F/9Mf1/wbtUN0fg==
@@ -24321,6 +24333,11 @@ xmlhttprequest-ssl@~1.6.2:
2432124333
resolved "https://registry.yarnpkg.com/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.6.3.tgz#03b713873b01659dfa2c1c5d056065b27ddc2de6"
2432224334
integrity sha512-3XfeQE/wNkvrIktn2Kf0869fC0BN6UpydVasGIeSm2B1Llihf7/0UfZM+eCkOw3P7bP4+qPgqhm7ZoxuJtFU0Q==
2432324335

24336+
xmlhttprequest-ssl@~2.0.0:
24337+
version "2.0.0"
24338+
resolved "https://registry.yarnpkg.com/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.0.0.tgz#91360c86b914e67f44dce769180027c0da618c67"
24339+
integrity sha512-QKxVRxiRACQcVuQEYFsI1hhkrMlrXHPegbbd1yn9UHOmRxY+si12nQYzri3vbzt8VdTTRviqcKxcyllFas5z2A==
24340+
2432424341
xmlhttprequest@*, [email protected]:
2432524342
version "1.8.0"
2432624343
resolved "https://registry.yarnpkg.com/xmlhttprequest/-/xmlhttprequest-1.8.0.tgz#67fe075c5c24fef39f9d65f5f7b7fe75171968fc"

0 commit comments

Comments
 (0)