PT-2023-29702 · Unknown · Apollo Router
Bryncooke
+1
·
Published
2023-10-18
·
Updated
2023-10-30
·
CVE-2023-45812
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Apollo Router versions prior to 1.33.0
Description
The Apollo Router is subject to a Denial-of-Service (DoS) type issue that causes it to panic and terminate when a multi-part response is sent. This occurs when users send queries to the router that use the
@defer or Subscriptions, and the router is configured with a coprocessor having coprocessor.supergraph.response in its router.yaml and supporting either @defer or Subscriptions.Recommendations
For versions prior to 1.33.0, upgrade to version 1.33.0 to resolve the issue.
As a temporary workaround for users unable to upgrade, consider avoiding the use of the coprocessor supergraph response or disabling defer and subscriptions support by setting
supergraph.defer support to false and subscription.enabled to false in the router.yaml configuration.Exploit
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apollo Router