CVE-2022-31183: fs2-io skips mTLS client verification

(updated )

When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:

  1. fs2-io running on Node.js. The JVM TLS implementation is completely independent.
  2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API.
  3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-31183 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →