166 lines
8.2 KiB
JSON
166 lines
8.2 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-41317",
|
||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "GitHub_M",
|
||
"dateReserved": "2023-08-28T16:56:43.365Z",
|
||
"datePublished": "2023-09-05T18:31:43.185Z",
|
||
"dateUpdated": "2024-09-30T19:17:12.220Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Unnamed \"Subscription\" operation results in Denial-of-Service in apollographql/router",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-755",
|
||
"lang": "en",
|
||
"description": "CWE-755: Improper Handling of Exceptional Conditions",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 7.5,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx",
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx"
|
||
},
|
||
{
|
||
"name": "https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa"
|
||
},
|
||
{
|
||
"name": "https://github.com/apollographql/router/releases/tag/v1.29.1",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/apollographql/router/releases/tag/v1.29.1"
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "apollographql",
|
||
"product": "router",
|
||
"versions": [
|
||
{
|
||
"version": ">= 1.28.0, < 1.29.1",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"shortName": "GitHub_M",
|
||
"dateUpdated": "2023-09-05T18:31:43.185Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the following conditions are met**: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 (\"impacted versions\"); **and** 2. The Supergraph schema provided to the Router (either via Apollo Uplink or explicitly via other configuration) **has a `subscription` type** with root-fields defined; **and** 3. The YAML configuration provided to the Router **has subscriptions enabled** (they are _disabled_ by default), either by setting `enabled: true` _or_ by setting a valid `mode` within the `subscriptions` object (as seen in [subscriptions' documentation](https://www.apollographql.com/docs/router/executing-operations/subscription-support/#router-setup)); **and** 4. An [anonymous](https://spec.graphql.org/draft/#sec-Anonymous-Operation-Definitions) (i.e., un-named) `subscription` operation (e.g., `subscription { ... }`) is received by the Router If **all four** of these criteria are met, the impacted versions will panic and terminate. There is no data-privacy risk or sensitive-information exposure aspect to this vulnerability. This is fixed in Apollo Router v1.29.1. Users are advised to upgrade. Updating to v1.29.1 should be a clear and simple upgrade path for those running impacted versions. However, if Subscriptions are **not** necessary for your Graph – but are enabled via configuration — then disabling subscriptions is another option to mitigate the risk."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-w8vq-3hf9-xppx",
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T18:54:05.149Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx",
|
||
"tags": [
|
||
"x_refsource_CONFIRM",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx"
|
||
},
|
||
{
|
||
"name": "https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa"
|
||
},
|
||
{
|
||
"name": "https://github.com/apollographql/router/releases/tag/v1.29.1",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/apollographql/router/releases/tag/v1.29.1"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-09-30T19:17:04.266143Z",
|
||
"id": "CVE-2023-41317",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-30T19:17:12.220Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |