GitHub Advisoryadvisory · Maven

GHSA-g56x-7j6w-g8r8 Grackle has StackOverflowError in GraphQL query processing

HIGH Published 2023-12-18 Modified 2023-12-22 Official page ↗
Aliases
CVE-2023-50730
Ecosystem
Maven
Packages
org.typelevel:grackle-core_2.13, org.typelevel:grackle-core_3, org.typelevel:grackle-core_sjs1_2.13, org.typelevel:grackle-core_sjs1_3, org.typelevel:grackle-core_native0.4_2.13, org.typelevel:grackle-core_native0.4_3, edu.gemini:gsp-graphql-core_2.13, edu.gemini:gsp-graphql-core_3, edu.gemini:gsp-graphql-core_sjs1_2.13, edu.gemini:gsp-graphql-core_sjs1_3, edu.gemini:gsp-graphql-core_native0.4_2.13, edu.gemini:gsp-graphql-core_native0.4_3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-12-18

Affected packages

• Maven org.typelevel:grackle-core_2.13: < 0.18.0 → fixed in 0.18.0 • Maven org.typelevel:grackle-core_3: < 0.18.0 → fixed in 0.18.0 • Maven org.typelevel:grackle-core_sjs1_2.13: < 0.18.0 → fixed in 0.18.0 • Maven org.typelevel:grackle-core_sjs1_3: < 0.18.0 → fixed in 0.18.0 • Maven org.typelevel:grackle-core_native0.4_2.13: < 0.18.0 → fixed in 0.18.0 • Maven org.typelevel:grackle-core_native0.4_3: < 0.18.0 → fixed in 0.18.0 • Maven edu.gemini:gsp-graphql-core_2.13: <= 0.14.0 (no fix yet) • Maven edu.gemini:gsp-graphql-core_3: <= 0.14.0 (no fix yet) • Maven edu.gemini:gsp-graphql-core_sjs1_2.13: <= 0.14.0 (no fix yet) • Maven edu.gemini:gsp-graphql-core_sjs1_3: <= 0.14.0 (no fix yet) • Maven edu.gemini:gsp-graphql-core_native0.4_2.13: <= 0.14.0 (no fix yet) • Maven edu.gemini:gsp-graphql-core_native0.4_3: <= 0.14.0 (no fix yet)

Description

Impact Prior to this fix, the GraphQL query parsing was vulnerable to `StackOverflowError`s. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. > [!CAUTION] > No specific knowledge of an application's GraphQL schema would be required to construct a pathological query. Patches The stack overflow issues have been resolved in the v0.18.0 release of Grackle. Workarounds Users could interpose a sanitizing layer in between untrusted input and Grackle query processing.

Related

Alias · CVE (1)

  • CVE-2023-50730 Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References