PT-2022-16784 · Apple · Swift-Nio-Http2

Published 2022-02-09 · Updated 2023-05-18 · CVE-2022-24666

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions 1.0.0 through 1.19.1

Description A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack is caused by a logical error when parsing a HTTP/2 HEADERS frame where the frame contains priority information without any other data, leading to a parsing error that immediately crashes the entire process. The attack is low-effort and has a high impact on availability, as receiving the frame crashes the server and causes the service to need to restart. The attack does not have any confidentiality or integrity risks in and of itself, but sudden process crashes can lead to violations of invariants in services, potentially triggering an error condition with confidentiality or integrity risks.

Recommendations For versions 1.0.0 through 1.19.1, update to version 1.19.2 or later to fix the issue. As a temporary workaround, consider restricting access to untrusted peers to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2022-24666

GHSA-CCW9-Q5H2-8C2W

GHSA-PV7R-9VJG-G3F9

Affected Products

Swift-Nio-Http2

References · 8

• https://osv.dev/vulnerability/GHSA-pv7r-9vjg-g3f9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ccw9-q5h2-8c2w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24666 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24666 · Vendor Advisory
• https://github.com/apple/swift-nio-http2/security/advisories/GHSA-ccw9-q5h2-8c2w · Note
• https://github.com/apple/swift-nio-http2 · Note
• https://github.com/apple/swift-nio-http2/commit/93215774aa7d223a5ad5aa0b80453375d669fa8f · Note
• https://github.com/apple/swift-nio-http2/releases/tag/1.19.2 · Note