CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32742 – Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash
https://notcve.org/view.php?id=CVE-2021-32742
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`. • https://github.com/vapor/vapor/releases/tag/4.47.2 https://github.com/vapor/vapor/security/advisories/GHSA-pqwh-c2f3-vxmq • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21328 – Denial of Service
https://notcve.org/view.php?id=CVE-2021-21328
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters. • https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23 https://github.com/vapor/vapor/releases/tag/4.40.1 https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc https://vapor.codes • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15230 – Arbitrary file read un Vapor
https://notcve.org/view.php?id=CVE-2020-15230
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4. Vapor es un framework web para Swift. • https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255 https://github.com/vapor/vapor/pull/2500 https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •