PT-2022-20452 · Vapor · Vapor

0Xtim + 1 · Published 2022-05-31 · Updated 2023-06-07 · CVE-2022-31005

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vapor versions prior to 4.60.3

Description Vapor is an HTTP web framework for Swift. Users with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. This issue can be triggered by invalid range headers.

Recommendations For versions prior to 4.60.3, update to version 4.60.3 to resolve the issue. As a temporary workaround, consider disabling FileMiddleware and serve assets via a Content Delivery Network.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2022-31005

GHSA-VJ2M-9F5J-MPR5

Affected Products

Vapor

References · 10

• 🔥 https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31005.json · Exploit
• https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1 · Patch
• https://osv.dev/vulnerability/CVE-2022-31005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vj2m-9f5j-mpr5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31005 · Security Note
• https://github.com/vapor/vapor · Note
• https://github.com/vapor/vapor/releases/tag/4.60.3 · Note
• https://t.me/cvenotify/30937 · Telegram Post
• https://t.me/cibsecurity/43581 · Telegram Post