Unchecked Input for Loop Condition Affecting github.com/apple/swift-nio-extras package, versions <1.9.2 >=1.10.0 <1.10.3 >=1.11.0 <1.14.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SWIFT-APPLESWIFTNIOEXTRAS-3097826
- published 6 Nov 2022
- disclosed 2 Nov 2022
- credit Vojtech Rylko
Introduced: 2 Nov 2022
CVE-2022-3252 Open this link in a new tabHow to fix?
Upgrade apple/swift-nio-extras to version 1.9.2, 1.10.3, 1.14.0 or higher.
Overview
apple/swift-nio-extras is an useful code around SwiftNIO.
Affected versions of this package are vulnerable to Unchecked Input for Loop Condition. SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies.
These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) failed to detect when the decompressed body was considered complete.
If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service.