Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tZ2M0LXdxdjctNHB4bc4AAzZP

SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header

Impact

Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.

This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.

Workarounds

No workaround is available, users must upgrade.

References

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605

Permalink: https://github.com/advisories/GHSA-mgc4-wqv7-4pxm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZ2M0LXdxdjctNHB4bc4AAzZP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 12 months ago
Updated: 11 months ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-mgc4-wqv7-4pxm
References: Repository: https://github.com/apple/swift-nio
Blast Radius: 29.2

Affected Packages

swift:github.com/apple/swift-nio
Dependent packages: 205
Dependent repositories: 950
Downloads:
Affected Version Ranges: >= 2.0.0, < 2.13.1, >= 1.0.0, < 1.14.2
Fixed in: 2.13.1, 1.14.2
All affected versions: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13.0, 1.13.1, 1.13.2, 1.14.0, 1.14.1, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.13.0
All unaffected versions: 1.14.2, 1.14.3, 1.14.4, 2.13.1, 2.14.0, 2.15.0, 2.16.0, 2.16.1, 2.17.0, 2.18.0, 2.19.0, 2.20.0, 2.20.1, 2.20.2, 2.21.0, 2.22.0, 2.22.1, 2.23.0, 2.24.0, 2.25.0, 2.25.1, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.29.1, 2.30.0, 2.31.0, 2.31.1, 2.31.2, 2.32.0, 2.32.1, 2.32.2, 2.32.3, 2.33.0, 2.34.0, 2.35.0, 2.36.0, 2.37.0, 2.38.0, 2.39.0, 2.39.1, 2.40.0, 2.41.0, 2.41.1, 2.42.0, 2.42.1, 2.43.0, 2.43.1, 2.44.0, 2.45.0, 2.46.0, 2.47.0, 2.48.0, 2.49.0, 2.50.0, 2.51.0, 2.51.1, 2.52.0, 2.53.0, 2.54.0, 2.55.0, 2.56.0, 2.57.0, 2.58.0, 2.59.0, 2.60.0, 2.61.0, 2.61.1, 2.62.0, 2.63.0