AppleGHSA-xhhr-p2r9-jmm7
Request/response decompression checks the size of compressed instead of decompressed bytes
HighCVE-2020-9840 · Published May 2, 2020
### Impact When using the `.size` decompression limit, request & response decompression checks the size of _compressed_ instead of _decompressed_ bytes which allows to remotely cause a denial-of-service in a client/server. ### Patches Released on `swift-nio-extras` version 1.4.1. ### Workarounds Use the `.ratio` decompression limit. ### Thanks Many thanks to @adtrevor for the bug report & fix.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| swift-nio-extras Product | < 1.4.1 | 1.4.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Apple advisories
All Apple| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 172020 | HTTP request smuggling using malformed Transfer-Encoding header | Critical | 1.14.2 |
| Nov 252019 | Executable Stack | Medium | 2.4.1 |
| Aug 132019 | Apple: denial of service | High | 1.5.0 |
| Aug 132019 | Apple: denial of service | High | 1.5.0 |
| Aug 132019 | Apple: denial of service | High | 1.5.0 |
| Aug 132019 | Apple: denial of service | High | 1.5.0 |