PT-2022-21351 · Unknown · Swiftnio Extras
Vojtarylko
+1
·
Published
2022-09-21
·
Updated
2023-06-07
·
CVE-2022-3252
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SwiftNIO Extras (affected versions not specified)
Description
The issue is related to improper detection of complete HTTP body decompression in SwiftNIO Extras. This can lead to an infinite loop and denial-of-service when trailing junk data is appended to the HTTP message body. The attack is low effort and can be triggered by any attacker capable of sending a compressed HTTP message, most commonly HTTP servers. The impact on availability is high, as the process immediately becomes unavailable but does not immediately crash. If left unchecked, this issue will very slowly exhaust memory resources due to repeated buffer allocation.
Recommendations
As a temporary workaround, consider removing transparent HTTP message decompression to mitigate the risk.
The issue is fixed by correctly detecting the termination of the compressed body as reported by zlib and refusing to decompress further data.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Swiftnio Extras