PT-2022-13302 · Apple · Swift-Nio-Http2

Lukasapublished · Published 2022-03-09 · Updated 2023-06-09 · CVE-2022-0618

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions 1.0.0 through 1.19.2

Description A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH PROMISE frame where the frame contains padding information without any other data. The attack is low-effort and has a high impact on availability, as receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. The attack does not have any confidentiality or integrity risks in and of itself, but sudden process crashes can lead to violations of invariants in services, potentially triggering an error condition with confidentiality or integrity risks.

Recommendations For versions 1.0.0 through 1.19.2, update to version 1.20.0 or later to fix the issue. As a temporary workaround, consider restricting access to untrusted peers to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2022-0618

GHSA-Q36X-R5X4-H4Q6

Affected Products

Swift-Nio-Http2

References · 7

• https://osv.dev/vulnerability/CVE-2022-0618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0618 · Security Note
• https://osv.dev/vulnerability/GHSA-q36x-r5x4-h4q6 · Vendor Advisory
• https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q36x-r5x4-h4q6 · Note
• https://github.com/apple/swift-nio-http2 · Note
• https://github.com/apple/swift-nio-http2/commit/ac2a5afce3dbb6795b4f78ec3f19726dc28f5617 · Note
• https://t.me/cibsecurity/38670 · Telegram Post