CVE-2022-3215: Github.com/apple/swift nio SwiftNIO Vulnerable To Improper Neutralization Vulnerability
MODERATECVE-2022-3215 is a MODERATE (CVSS 5.3) swiftnio vulnerable to improper neutralization vulnerability (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')) affecting Github.com/apple/swift nio libraries in the SwiftURL ecosystem. The issue involves swiftnio vulnerable to improper neutralization of crlf sequences in http headers ('http response splitting'). Remediation is available by upgrading affected packages to version 2.42.0, 2.39.1, 2.29.1.
CVE-2022-3215 at a Glance
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
How to Fix CVE-2022-3215
To remediate this vulnerability, upgrade all affected Github.com/apple/swift nio dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/apple/swift-nio to 2.42.0Upgrade github.com/apple/swift-nio to 2.39.1Upgrade github.com/apple/swift-nio to 2.29.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/apple/swift-nioHow to Check if You Are Affected
To determine whether your application is affected by CVE-2022-3215, inspect your project dependencies for Github.com/apple/swift nio:
inspect dependencies for github.com/apple/swift-nioAnalyze the terminal output to locate any version of Github.com/apple/swift nio in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.42.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), where the product receives data from an http agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes cr and lf characters before the data is included in outgoing http headers. In Github.com/apple/swift nio, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-3215 Affected Github.com/apple/swift nio Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/apple/swift-nio
|
SwiftURL |
≥ 2.41.0
< 2.42.0
|
2.42.0
|
|
github.com/apple/swift-nio
|
SwiftURL |
≥ 2.39.0
< 2.39.1
|
2.39.1
|
|
github.com/apple/swift-nio
|
SwiftURL |
< 2.29.1
|
2.29.1
|
References
Frequently Asked Questions
What is CVE-2022-3215?
Which Github.com/apple/swift nio versions are affected?
What version fixes CVE-2022-3215?
Is github.com/apple/swift-nio affected?
What is the CVSS score of CVE-2022-3215?
What CWE is associated with CVE-2022-3215?
How can I check SwiftURL dependencies for CVE-2022-3215?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7fj7-39wj-c64f",
"modified" : "2023-06-07T16:01:53Z",
"published" : "2023-06-07T16:01:53Z",
"aliases" : [ "CVE-2022-3215" ],
"summary" : "SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')",
"details" : "`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and \"inject\" those newlines into the returned HTTP response.\n\nThis capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws.\n\nThis issue was resolved by adding a default channel handler that polices outbound headers. This channel handler is added by default to channel pipelines, but can be removed by users if they are doing this validation themselves.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "SwiftURL",
"name" : "github.com/apple/swift-nio"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.41.0"
}, {
"fixed" : "2.42.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "SwiftURL",
"name" : "github.com/apple/swift-nio"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.39.0"
}, {
"fixed" : "2.39.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "SwiftURL",
"name" : "github.com/apple/swift-nio"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.29.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-3215"
}, {
"type" : "WEB",
"url" : "https://github.com/apple/swift-nio/commit/a16e2f54a25b2af217044e5168997009a505930f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apple/swift-nio"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-113", "CWE-74" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-06-07T16:01:53Z",
"nvd_published_at" : "2022-09-28T20:15:00Z"
}
}