GitHub Advisoryadvisory · SwiftURL

GHSA-vj2m-9f5j-mpr5 Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware

HIGH Published 2023-06-07 Modified 2023-06-07 Official page ↗
Aliases
CVE-2022-31005
Ecosystem
SwiftURL
Packages
github.com/vapor/vapor
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190
Reviewed
2023-06-07

Affected packages

• SwiftURL github.com/vapor/vapor: < 4.60.3 → fixed in 4.60.3

Description

Vapor is an HTTP web framework for Swift and middleware is a logic chain between the client and a Vapor route handler. FileMiddleware enables the serving of assets from the Public folder of a project to the client. Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow when given invalid range headers while using FileMiddleware. This is patched in 4.60.3.

Related

Alias · CVE (1)

  • CVE-2022-31005 Vapor is an HTTP web framework for Swift. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References