PT-2023-29220 · Vapor · Vapor

T0Rchwo0D · Published 2023-10-05 · Updated 2023-10-11 · CVE-2023-44386

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Vapor versions prior to 4.84.2

Description There is a denial of service issue impacting all users of affected versions of Vapor, an HTTP web framework for Swift. The HTTP1 error handler closed connections when HTTP parse errors occurred instead of passing them on. This issue causes immediate termination of the server process due to API misuse, resulting in an immediately recoverable service interruption. There is no corruption of process state and no risk of data leakage or unauthorized code execution.

Recommendations For versions prior to 4.84.2, update to Vapor release 4.84.2 to resolve the issue. As a temporary workaround, consider implementing error handling mechanisms to prevent server process termination due to HTTP parse errors. However, the most effective solution is to update to the fixed version.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-696

CWE-231

CWE-617

Related Identifiers

CVE-2023-44386

GHSA-3MWQ-H3G6-FFHM

Affected Products

Vapor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44386.json · Exploit
• https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-44386 · Security Note
• https://osv.dev/vulnerability/GHSA-3mwq-h3g6-ffhm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44386 · Vendor Advisory
• https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm · Note
• https://github.com/vapor/vapor · Note
• https://github.com/vapor/vapor/releases/tag/4.84.2 · Note
• https://twitter.com/VulmonFeeds/status/1710035861662822883 · Twitter Post
• https://twitter.com/CVEnew/status/1709990188309754239 · Twitter Post
• https://t.me/cibsecurity/71682 · Telegram Post