From c5d3345cf067e38a4d53f10eb4bea3d958c05dc8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 18 Dec 2023 23:28:06 +0000
Subject: [PATCH] Publish GHSA-g56x-7j6w-g8r8

---
 .../GHSA-g56x-7j6w-g8r8.json                  | 274 ++++++++++++++++++
 1 file changed, 274 insertions(+)
 create mode 100644 advisories/github-reviewed/2023/12/GHSA-g56x-7j6w-g8r8/GHSA-g56x-7j6w-g8r8.json

diff --git a/advisories/github-reviewed/2023/12/GHSA-g56x-7j6w-g8r8/GHSA-g56x-7j6w-g8r8.json b/advisories/github-reviewed/2023/12/GHSA-g56x-7j6w-g8r8/GHSA-g56x-7j6w-g8r8.json
new file mode 100644
index 00000000000..e10b2a6b44f
--- /dev/null
+++ b/advisories/github-reviewed/2023/12/GHSA-g56x-7j6w-g8r8/GHSA-g56x-7j6w-g8r8.json
@@ -0,0 +1,274 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g56x-7j6w-g8r8",
+  "modified": "2023-12-18T23:26:52Z",
+  "published": "2023-12-18T23:26:52Z",
+  "aliases": [
+    "CVE-2023-50730"
+  ],
+  "summary": "Grackle has StackOverflowError in GraphQL query processing",
+  "details": "### Impact\n\nPrior to this fix, the GraphQL query parsing was vulnerable to `StackOverflowError`s. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability.\n\nThis potentially affects all applications using Grackle which have untrusted users.\n\n> [!CAUTION]  \n> **No specific knowledge of an application's GraphQL schema would be required to construct a pathological query.**\n\n### Patches\nThe stack overflow issues have been resolved in the v0.18.0 release of Grackle.\n\n### Workarounds\nUsers could interpose a sanitizing layer in between untrusted input and Grackle query processing.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_sjs1_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_sjs1_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_native0.4_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.typelevel:grackle-core_native0.4_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_sjs1_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_sjs1_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_native0.4_2.13"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "edu.gemini:gsp-graphql-core_native0.4_3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.14.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/typelevel/grackle"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/typelevel/grackle/releases/tag/v0.18.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-12-18T23:26:52Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file