high7.5
CVE-2023-50730
Grackle has StackOverflowError in GraphQL query processing
Impact
### Impact Prior to this fix, the GraphQL query parsing was vulnerable to `StackOverflowError`s. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. > [!CAUTION] > **No specific knowledge of an application's GraphQL schema would be required to construct a pathological query.** ### Patches The stack overflow issues have been resolved in the v0.18.0 release of Grackle. ### Workarounds Users could interpose a sanitizing layer in between untrusted input and Grackle query processing.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.typelevel:grackle-core_2.13 | < 0.18.0 | 0.18.0 |
| maven | org.typelevel:grackle-core_3 | < 0.18.0 | 0.18.0 |
| maven | org.typelevel:grackle-core_sjs1_2.13 | < 0.18.0 | 0.18.0 |
| maven | org.typelevel:grackle-core_sjs1_3 | < 0.18.0 | 0.18.0 |
| maven | org.typelevel:grackle-core_native0.4_2.13 | < 0.18.0 | 0.18.0 |
| maven | org.typelevel:grackle-core_native0.4_3 | < 0.18.0 | 0.18.0 |
| maven | edu.gemini:gsp-graphql-core_2.13 | <= 0.14.0 | none recorded |
| maven | edu.gemini:gsp-graphql-core_3 | <= 0.14.0 | none recorded |
| maven | edu.gemini:gsp-graphql-core_sjs1_2.13 | <= 0.14.0 | none recorded |
| maven | edu.gemini:gsp-graphql-core_sjs1_3 | <= 0.14.0 | none recorded |
| maven | edu.gemini:gsp-graphql-core_native0.4_2.13 | <= 0.14.0 | none recorded |
| maven | edu.gemini:gsp-graphql-core_native0.4_3 | <= 0.14.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Typelevel | Grackle | before 0.18.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd
- https://github.com/typelevel/grackle/releases/tag/v0.18.0
- https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8
- https://github.com/advisories/GHSA-g56x-7j6w-g8r8
- https://nvd.nist.gov/vuln/detail/CVE-2023-50730