CVE catalog
CVE-2024-38355
Security update for pgadmin4
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.81% · Oct 25, 2026
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Npm | socket.io | Not reported | 2.5.1 | fixed |
| Npm | socket.io | Not reported | 4.6.2 | fixed |
| Suse | pgadmin4 | linux enterprise module for python 3 15 sp6 | 8.5-150600.3.6.1 | fixed |
| Opensuse | pgadmin4 | leap 15.6 | 8.5-150600.3.6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Npm | socket.io | npm | Not reported | 2.5.1 | Not reported | GHSA-25HC-QCG6-38WJ | Not reported |
| Npm | socket.io | npm | Not reported | 4.6.2 | Not reported | Not reported | Not reported |
| Suse | pgadmin4 | rpm | linux enterprise module for python 3 15 sp6 | 8.5-150600.3.6.1 | Not reported | SUSE-SU-2024:3771-1 | Not reported |
| Opensuse | pgadmin4 | rpm | leap 15.6 | 8.5-150600.3.6.1 | Not reported | SUSE-SU-2024:3771-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-773256.json]
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3771-1.json]
- [https://github.com/advisories/GHSA-25hc-qcg6-38wj]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3771-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38355.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2091.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]