diff --git a/advisories/github-reviewed/2025/04/GHSA-84m6-5m72-45fp/GHSA-84m6-5m72-45fp.json b/advisories/github-reviewed/2025/04/GHSA-84m6-5m72-45fp/GHSA-84m6-5m72-45fp.json index fe867e9930b..5fe60922c16 100644 --- a/advisories/github-reviewed/2025/04/GHSA-84m6-5m72-45fp/GHSA-84m6-5m72-45fp.json +++ b/advisories/github-reviewed/2025/04/GHSA-84m6-5m72-45fp/GHSA-84m6-5m72-45fp.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-84m6-5m72-45fp", - "modified": "2025-04-07T18:59:21Z", + "modified": "2025-04-07T21:11:23Z", "published": "2025-04-07T18:59:21Z", - "aliases": [], + "aliases": [ + "CVE-2025-32033" + ], "summary": "Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow", "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Router allowed certain queries to bypass configured operation limits, specifically due to integer overflow.\n\n## Details\n\nThe operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments.\n\n## Fix/Mitigation\n\nLogic was updated to ensure counter overflow is handled correctly and does not wrap around to 0.\n\n# Patches\n\nThis has been remediated in `apollo-router` versions 1.61.2 and 2.1.1.\n\n# Workarounds\n\nThe only known workaround is \"Safelisting\" or \"Safelisting with IDs only\" per [Safelisting with Persisted Queries - Apollo GraphQL Docs](https://www.apollographql.com/docs/graphos/routing/security/persisted-queries#router-security-levels).\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of operation limiting mechanisms.", "severity": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-94hh-jmq8-2fgp/GHSA-94hh-jmq8-2fgp.json b/advisories/github-reviewed/2025/04/GHSA-94hh-jmq8-2fgp/GHSA-94hh-jmq8-2fgp.json index 532dfc6e3be..6885123188d 100644 --- a/advisories/github-reviewed/2025/04/GHSA-94hh-jmq8-2fgp/GHSA-94hh-jmq8-2fgp.json +++ b/advisories/github-reviewed/2025/04/GHSA-94hh-jmq8-2fgp/GHSA-94hh-jmq8-2fgp.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-94hh-jmq8-2fgp", - "modified": "2025-04-07T18:56:30Z", + "modified": "2025-04-07T21:10:48Z", "published": "2025-04-07T18:56:30Z", - "aliases": [], + "aliases": [ + "CVE-2025-32032" + ], "summary": "Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass", "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service.\n\n## Details\n\nThe query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can exhaust router's thread pool, rendering it inoperable.\n\n## Fix/Mitigation\n\n- A new **Query Optimization Limit** metric has been added:\n - This metric approximates the number of selections that cannot be skipped by the existing optimization.\n - The metric is checked against a limit to prevent excessive computation.\n\nGiven the complexity of query planning optimizations, we will continue refining these solutions based on real-world performance and accuracy tests.\n\n# Patches\n\nThis has been remediated in `apollo-router` versions 1.61.2 and 2.1.1.\n\n# Workarounds\n\nThe only known workaround is \"Safelisting\" or \"Safelisting with IDs only\" per [Safelisting with Persisted Queries - Apollo GraphQL Docs](https://www.apollographql.com/docs/graphos/routing/security/persisted-queries#router-security-levels).\n\n# References\n\n[Query Planning Documentation](https://www.apollographql.com/docs/graphos/reference/federation/query-plans)\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.", "severity": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-p2q6-pwh5-m6jr/GHSA-p2q6-pwh5-m6jr.json b/advisories/github-reviewed/2025/04/GHSA-p2q6-pwh5-m6jr/GHSA-p2q6-pwh5-m6jr.json index bdfeeda513b..7e6f0726f2f 100644 --- a/advisories/github-reviewed/2025/04/GHSA-p2q6-pwh5-m6jr/GHSA-p2q6-pwh5-m6jr.json +++ b/advisories/github-reviewed/2025/04/GHSA-p2q6-pwh5-m6jr/GHSA-p2q6-pwh5-m6jr.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-p2q6-pwh5-m6jr", - "modified": "2025-04-07T19:03:16Z", + "modified": "2025-04-07T21:10:33Z", "published": "2025-04-07T19:03:16Z", - "aliases": [], + "aliases": [ + "CVE-2025-32031" + ], "summary": "Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass", "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service.\n\n## Details\n\nThe query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable.\n\n## Fix/Mitigation\n\n- A new **Query Optimization Limit** metric has been added:\n - This metric approximates the number of selections that cannot be skipped by the existing optimization.\n - The metric is checked against a limit to prevent excessive computation.\n\nGiven the complexity of query planning optimizations, we will continue refining these solutions based on real-world performance and accuracy tests.\n\n# Patches\n\nThis has been remediated in `@apollo/gateway` version 2.10.1.\n\n# Workarounds\n\nNo known direct workarounds exist.\n\n# References\n\n[Query Planning Documentation](https://www.apollographql.com/docs/graphos/reference/federation/query-plans)\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.", "severity": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-p4qw-7j9g-5h53/GHSA-p4qw-7j9g-5h53.json b/advisories/github-reviewed/2025/04/GHSA-p4qw-7j9g-5h53/GHSA-p4qw-7j9g-5h53.json new file mode 100644 index 00000000000..7b4dac4284c --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-p4qw-7j9g-5h53/GHSA-p4qw-7j9g-5h53.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p4qw-7j9g-5h53", + "modified": "2025-04-07T21:11:19Z", + "published": "2025-04-07T21:11:19Z", + "aliases": [ + "CVE-2025-32029" + ], + "summary": "ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation", + "details": "### Impact\n\nIncorrect `number` DER encoding can lead to denial on service for absolute values in the range `2**31` -- `2**32 - 1`. The arithmetic in the `numBitLen` didn't take into account that values in this range could result in a negative result upon applying the `>>` operator, leading to an infinite loop.\n\nIn addition, `number` encoding had a few other issues that resulted it in it not encoding values correctly.\n\n### Patches\n\nThe issue is patched in version `1.0.4`. Users are recommended to upgrade as soon as possible.\n\n### Workarounds\n\nIf upgrading is not an option, the issue can be mitigated by validating inputs to `Asn1Integer` to ensure that they are not smaller than `-2**31 + 1` and no larger than `2**31 - 1`. Although `Asn1Integer` supports `bigint` inputs, some additional implementation issues make using `bigint` as a mitigation inviable, as it will result in incorrect values.\n\nIf upgrading is not an option and range checks are impractical or undesirable, input to `Asn1Integer` can be provided as a buffer to be used directly. Note that this requires computing the correct DER encoding externally.\n\n### References\n\nN/A", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@apeleghq/asn1-der" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ApelegHQ/ts-asn1-der/security/advisories/GHSA-p4qw-7j9g-5h53" + }, + { + "type": "WEB", + "url": "https://github.com/ApelegHQ/ts-asn1-der/commit/b2bc9032cbe19755d234a27d79e47a7e52993af8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ApelegHQ/ts-asn1-der" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1335", + "CWE-835" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T21:11:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-q2f9-x4p4-7xmh/GHSA-q2f9-x4p4-7xmh.json b/advisories/github-reviewed/2025/04/GHSA-q2f9-x4p4-7xmh/GHSA-q2f9-x4p4-7xmh.json index 532eccf2711..aaa4be95e6c 100644 --- a/advisories/github-reviewed/2025/04/GHSA-q2f9-x4p4-7xmh/GHSA-q2f9-x4p4-7xmh.json +++ b/advisories/github-reviewed/2025/04/GHSA-q2f9-x4p4-7xmh/GHSA-q2f9-x4p4-7xmh.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-q2f9-x4p4-7xmh", - "modified": "2025-04-07T19:03:10Z", + "modified": "2025-04-07T21:10:13Z", "published": "2025-04-07T19:03:10Z", - "aliases": [], + "aliases": [ + "CVE-2025-32030" + ], "summary": "Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion", "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.\n\n## Details\n\nNamed fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved.\n\n## Fix/Mitigation\n\nA new **Query Fragment Expansion Limit** metric has been introduced:\n - This metric computes the number of selections a query would have if its fragment spreads were fully expanded.\n - The metric is checked against a limit to prevent excessive computation.\n\n# Patches\n\nThis has been remediated in `@apollo/gateway` version 2.10.1.\n\n# Workarounds\n\nNo known direct workarounds exist.\n\n# References\n\n[Query Planning Documentation](https://www.apollographql.com/docs/graphos/reference/federation/query-plans)\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.", "severity": [