GHSA-g56x-7j6w-g8r8HighCVSS 7.5

Grackle has StackOverflowError in GraphQL query processing

Published
December 18, 2023
Last Modified
December 22, 2023

🔗 CVE IDs covered (1)

CVE-2023-50730 →

📋 Description

Impact

Prior to this fix, the GraphQL query parsing was vulnerable to StackOverflowErrors. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability.

This potentially affects all applications using Grackle which have untrusted users.

[!CAUTION]
No specific knowledge of an application's GraphQL schema would be required to construct a pathological query.

Patches

The stack overflow issues have been resolved in the v0.18.0 release of Grackle.

Workarounds

Users could interpose a sanitizing layer in between untrusted input and Grackle query processing.

🎯 Affected products12

  • maven/org.typelevel:grackle-core_2.13:< 0.18.0
  • maven/org.typelevel:grackle-core_3:< 0.18.0
  • maven/org.typelevel:grackle-core_sjs1_2.13:< 0.18.0
  • maven/org.typelevel:grackle-core_sjs1_3:< 0.18.0
  • maven/org.typelevel:grackle-core_native0.4_2.13:< 0.18.0
  • maven/org.typelevel:grackle-core_native0.4_3:< 0.18.0
  • maven/edu.gemini:gsp-graphql-core_2.13:<= 0.14.0
  • maven/edu.gemini:gsp-graphql-core_3:<= 0.14.0
  • maven/edu.gemini:gsp-graphql-core_sjs1_2.13:<= 0.14.0
  • maven/edu.gemini:gsp-graphql-core_sjs1_3:<= 0.14.0
  • maven/edu.gemini:gsp-graphql-core_native0.4_2.13:<= 0.14.0
  • maven/edu.gemini:gsp-graphql-core_native0.4_3:<= 0.14.0

🔗 References (5)