critical9.8
CVE-2019-8849
SwiftNIO SSL arbitrary code execution vulnerability
Impact
A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| swift | github.com/apple/swift-nio-ssl | >= 2.0.0, < 2.4.1 | 2.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Swiftnio Ssl | before 2.4.1 |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://support.apple.com/HT210772
- https://github.com/advisories/GHSA-frg3-gpcx-968f
- https://nvd.nist.gov/vuln/detail/CVE-2019-8849
- https://github.com/apple/swift-nio-ssl/commit/109faef770994e71b6bafcc015e2e96b88a4af8c
- https://github.com/apple/swift-nio-ssl/releases/tag/2.4.1
- https://security.snyk.io/vuln/SNYK-COCOAPODS-SWIFTNIOSSL-8492737