PT-2022-23922 · Unknown · Graphql-Go

Wgh · Published 2022-08-01 · Updated 2022-08-23 · CVE-2022-37315

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions graphql-go (aka GraphQL for Go) versions 0.8.0 and earlier

Description The issue concerns infinite recursion in the type definition parser.

Recommendations For versions 0.8.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2022-37315

GHSA-H3QM-JRRF-CGJ3

GO-2022-0942

Affected Products

Graphql-Go

References · 13

• 🔥 https://github.com/graphql-go/graphql/issues/637 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37315 · Security Note
• https://ubuntu.com/security/CVE-2022-37315 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37315 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-37315 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37315 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0942 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h3qm-jrrf-cgj3 · Vendor Advisory
• https://github.com/graphql-go/graphql/pull/642 · Note
• https://github.com/graphql-go/graphql/pull/642/commits/4188bd5b3877f7badb951b421cf66e0af2eacb22 · Note
• https://github.com/graphql-go/graphql · Note
• https://pkg.go.dev/vuln/GO-2022-0942 · Note
• https://t.me/cibsecurity/47392 · Telegram Post