{"containers": {"cna": {"affected": [{"product": "vapor", "vendor": "vapor", "versions": [{"status": "affected", "version": "<= 4.40.0"}]}], "descriptions": [{"lang": "en", "value": "Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-02-26T01:45:23", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/vapor/vapor/releases/tag/4.40.1"}, {"tags": ["x_refsource_MISC"], "url": "https://vapor.codes/"}], "source": {"advisory": "GHSA-gcj9-jj38-hwmc", "discovery": "UNKNOWN"}, "title": "Denial of Service", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21328", "STATE": "PUBLIC", "TITLE": "Denial of Service"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "vapor", "version": {"version_data": [{"version_value": "<= 4.40.0"}]}}]}, "vendor_name": "vapor"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc", "refsource": "CONFIRM", "url": "https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc"}, {"name": "https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23", "refsource": "MISC", "url": "https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23"}, {"name": "https://github.com/vapor/vapor/releases/tag/4.40.1", "refsource": "MISC", "url": "https://github.com/vapor/vapor/releases/tag/4.40.1"}, {"name": "https://vapor.codes/", "refsource": "MISC", "url": "https://vapor.codes/"}]}, "source": {"advisory": "GHSA-gcj9-jj38-hwmc", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21328", "datePublished": "2021-02-26T01:45:23", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2021-02-26T01:45:23", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vapor_project:vapor:*:*:*:*:*:swift:*:*", "matchCriteriaId": "32D3906C-9106-4D07-8096-CE037C320D7A", "versionEndExcluding": "4.40.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters."}, {"lang": "es", "value": "Vapor es un framework para Swift.&#xa0;En Vapor versiones anteriores a 4.40.1, se presenta un ataque DoS contra cualquiera que inicie un backend de m\u00e9tricas para su aplicaci\u00f3n Vapor.&#xa0;El siguiente es el vector de ataque: 1. Enviar peticiones ilimitadas contra una instancia de vapor con diferentes rutas,&#xa0;esto crear\u00e1 contadores y temporizadores ilimitados, que eventualmente agotar\u00e1n el sistema.&#xa0;2. Los servicios aguas abajo tambi\u00e9n pueden sufrir este ataque al recibir spam con rutas de error.&#xa0;Esto ha sido parcheado en versi\u00f3n 4.40.1.&#xa0;El \"DefaultResponder\" reescribir\u00e1 cualquier ruta de rutas no definida para \"vapor_route_undefined\" para evitar contadores ilimitados"}], "id": "CVE-2021-21328", "lastModified": "2021-03-05T19:38:57.617", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-02-26T02:15:12.713", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/vapor/vapor/releases/tag/4.40.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://vapor.codes/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}