UBUNTU-CVE-2022-21708

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-21708
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-21708.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2022-21708
Related
Published
2022-01-21T23:15:00Z
Modified
2025-01-13T10:23:25Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version v1.3.0. The only known workaround for this issue is to disable the graphql.MaxDepth option from your schema which is not recommended.

References

Affected packages

Ubuntu:20.04:LTS / golang-github-graph-gophers-graphql-go

Package

Name
golang-github-graph-gophers-graphql-go
Purl
pkg:deb/ubuntu/golang-github-graph-gophers-graphql-go@0.0~git20180609.bb97385-2?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.0~git20180609.bb97385-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / golang-github-graph-gophers-graphql-go

Package

Name
golang-github-graph-gophers-graphql-go
Purl
pkg:deb/ubuntu/golang-github-graph-gophers-graphql-go@1.3.0-1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.0-1

Affected versions

0.*

0.0~git20180609.bb97385-2.1

1.*

1.2.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.3.0-1",
            "binary_name": "golang-github-graph-gophers-graphql-go-dev"
        }
    ]
}