Improper Check or Handling of Exceptional Conditions in apollo-router
CVE-2023-45812

7.5HIGH

Key Information:

Vendor

Apollographql

Status
Router
Vendor
CVE Published:
18 October 2023

What is CVE-2023-45812?

The Apollo Router, a high-performance graph router developed in Rust for federated supergraphs, is susceptible to a Denial-of-Service vulnerability. Specifically, certain configurations can lead the Router to panic and unexpectedly terminate when processing multi-part responses that employ the @defer directive or Subscriptions. This vulnerability necessitates that users have a coprocessor configured to support coprocessor.supergraph.response within their router.yaml. To mitigate risks, it is crucial to upgrade to Apollo Router version 1.33.0, where the issue has been resolved. Users unable to perform the upgrade should disable the use of defer and subscriptions or refrain from utilizing the coprocessor supergraph response.

Affected Version(s)

router >= 1.31.0, < 1.33.0

References

https://github.com/apollographql/router/security/advisori...
x_refsource_CONFIRM
https://github.com/apollographql/router/pull/4014
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.