GHSA-mgc4-wqv7-4pxm: Github.com/apple/swift nio SwiftNIO Vulnerable To HTTP Request Vulnerability
CRITICALGHSA-mgc4-wqv7-4pxm is a CRITICAL (CVSS 9.8) swiftnio vulnerable to http request vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')) affecting Github.com/apple/swift nio libraries in the SwiftURL ecosystem. The issue involves swiftnio vulnerable to http request smuggling using malformed transfer-encoding header. Remediation is available by upgrading affected packages to version 1.14.2, 2.13.1.
GHSA-mgc4-wqv7-4pxm at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to Fix GHSA-mgc4-wqv7-4pxm
To remediate this vulnerability, upgrade all affected Github.com/apple/swift nio dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/apple/swift-nio to 1.14.2Upgrade github.com/apple/swift-nio to 2.13.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/apple/swift-nioHow to Check if You Are Affected
To determine whether your application is affected by GHSA-mgc4-wqv7-4pxm, inspect your project dependencies for Github.com/apple/swift nio:
inspect dependencies for github.com/apple/swift-nioAnalyze the terminal output to locate any version of Github.com/apple/swift nio in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.14.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), where the product acts as an intermediary http agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed http requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. In Github.com/apple/swift nio, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-mgc4-wqv7-4pxm Affected Github.com/apple/swift nio Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/apple/swift-nio
|
SwiftURL |
≥ 1.0.0
< 1.14.2
|
1.14.2
|
|
github.com/apple/swift-nio
|
SwiftURL |
≥ 2.0.0
< 2.13.1
|
2.13.1
|
References
Frequently Asked Questions
What is GHSA-mgc4-wqv7-4pxm?
Which Github.com/apple/swift nio versions are affected?
What version fixes GHSA-mgc4-wqv7-4pxm?
Is github.com/apple/swift-nio affected?
What is the CVSS score of GHSA-mgc4-wqv7-4pxm?
What CWE is associated with GHSA-mgc4-wqv7-4pxm?
How can I check SwiftURL dependencies for GHSA-mgc4-wqv7-4pxm?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mgc4-wqv7-4pxm",
"modified" : "2023-05-18T17:29:43Z",
"published" : "2023-05-18T17:29:43Z",
"aliases" : [ ],
"summary" : "SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header",
"details" : "### Impact\n\nAffected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.\n\nThis vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module.\n\n### Workarounds\n\nNo workaround is available, users must upgrade.\n\n### References\n\nhttps://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "SwiftURL",
"name" : "github.com/apple/swift-nio"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.0.0"
}, {
"fixed" : "1.14.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "SwiftURL",
"name" : "github.com/apple/swift-nio"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.13.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/pull/1387"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/pull/1388"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apple/swift-nio"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-444" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2023-05-18T17:29:43Z",
"nvd_published_at" : null
}
}