Socket Firewall (socketdev/socket-registry-firewall) in registry mode prior to version 2.0.0 does not verify upstream TLS certificates by default due to configuration keys api_ssl_verify and upstream_ssl_verify defaulting to false when omitted. The OpenResty/Lua HTTP client accepts any certificate without validating the chain, including self-signed or untrusted certificates. This allows an attacker positioned to intercept traffic between Socket Firewall and the Socket API or upstream package registry to present crafted certificates and modify responses in transit, potentially substituting malicious package content or altering firewall allow/block decisions. Although setting api_ssl_verify and upstream_ssl_verify to true enables verification, versions before 1.1.334 did not emit the lua_ssl_trusted_certificate directive in the generated nginx configuration, preventing effective verification without manual configuration changes. Version 2.0.0 changes the default for these settings to true, improving security by enforcing certificate validation.

An attacker capable of intercepting traffic between the Socket Firewall and upstream services can exploit the lack of TLS certificate validation to present forged certificates. This can lead to modification of responses, including injecting malicious package content or manipulating firewall decisions, resulting in potential compromise of the package supply chain and firewall enforcement integrity. The CVSS 3.1 score of 8.1 (high severity) reflects the potential for information disclosure, high integrity impact, and low availability impact.

Upgrade to Socket Firewall version 2.0.0 or later, which enables upstream TLS certificate verification by default. For versions prior to 2.0.0, explicitly set api_ssl_verify: true and upstream_ssl_verify: true in socket.yml and ensure the nginx configuration includes lua_ssl_trusted_certificate to enable proper certificate validation. Manual patching of the generated configuration may be required for versions before 1.1.334. Since no official patch links are provided, consult the vendor documentation or release notes for detailed upgrade instructions.