Unchecked Input for Loop Condition Affecting github.com/apple/swift-nio-extras package, versions <1.9.2 >=1.10.0 <1.10.3 >=1.11.0 <1.14.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-SWIFT-APPLESWIFTNIOEXTRAS-3097826
- published 6 Nov 2022
- disclosed 2 Nov 2022
- credit Vojtech Rylko
How to fix?
apple/swift-nio-extras to version 1.9.2, 1.10.3, 1.14.0 or higher.
apple/swift-nio-extras is an useful code around SwiftNIO.
Affected versions of this package are vulnerable to Unchecked Input for Loop Condition. SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies.
These two objects (
HTTPResponseDecompressor) failed to detect when the decompressed body was considered complete.
If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service.