Advisoriesby IbisAppleGHSA-xhhr-p2r9-jmm7
Request/response decompression checks the size of compressed instead of decompressed bytes
Fix: upgrade to 1.4.1 or later
Impact
When using the .size decompression limit, request & response decompression checks the size of _compressed_ instead of _decompressed_ bytes which allows to remotely cause a denial-of-service in a client/server.
Patches
Released on swift-nio-extras version 1.4.1.
Workarounds
Use the .ratio decompression limit.
Thanks
Many thanks to @adtrevor for the bug report & fix.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| swift-nio-extras Product | < 1.4.1 | 1.4.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)