Skip to content

OkHttp vulnerability issues in Socket.io client dependency #722

New issue
New issue
Open
Open
OkHttp vulnerability issues in Socket.io client dependency#722

Description

@shivamsharma2710
shivamsharma2710
opened on Oct 11, 2022

Socket.IO Library has two vulnerabilities which are coming out from the internal OkHttp dependency. I've used the latest socket.io v2.1.0 which is using very old version 3.12.12 of OkHttp.

Following are the vulnerabilities:

  1. Improper Certificate Validation

  2. Information Exposure

Please give an estimate on when you're planning to fix these vulnerabilities?

PFA the complete vulnerability report,

Screenshot 2022-10-12 at 4 21 38 AM

Activity

  1. shivamsharma2710 commented on Mar 13, 2023

    @shivamsharma2710
    shivamsharma2710
    on Mar 13, 2023
    Author

    @darrachequesne Please give an ETA when will be new release coming out with this fix?

  2. nibexo commented on Jan 15, 2025

    @nibexo
    nibexo
    on Jan 15, 2025

    Almost 2 years pass, and vulnerable packages are still in SocketIO 😢

  3. shivamsharma2710 commented on Jan 16, 2025

    @shivamsharma2710
    shivamsharma2710
    on Jan 16, 2025
    Author

    @darrachequesne What key actions are we considering to take this year?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions