CVE-2022-24863: Denial of service in http-swagger
Impact Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system.
Patches Yes. Please upgrade to v1.2.6.
Workarounds A workaround is to restrict the path prefix to the "GET" method. As shown below func main() { r := mux.NewRouter()
r.PathPrefix("/swagger/").Handler(httpSwagger.Handler( httpSwagger.URL("http://localhost:1323/swagger/doc.json"), //The url pointing to API definition httpSwagger.DeepLinking(true), httpSwagger.DocExpansion("none"), httpSwagger.DomID("#swagger-ui"), )).Methods(http.MethodGet)
References Reporter dongguangli from https://www.huoxian.cn/ company
For more information If you have any questions or comments about this advisory: Open an issue in http-swagger
Other sources
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24863?
CVE-2022-24863 has a severity rating that indicates it allows for a denial of service (DOS) attack due to memory exhaustion.
How do I fix CVE-2022-24863?
To fix CVE-2022-24863, upgrade to version 1.2.6 of the affected software.
What software is affected by CVE-2022-24863?
CVE-2022-24863 affects the 'http-swagger' package from GitHub, specifically versions prior to 1.2.6.
What is a workaround for CVE-2022-24863?
A workaround for CVE-2022-24863 is to restrict the path prefix to the 'GET' method in your application.
Can CVE-2022-24863 lead to service outages?
Yes, CVE-2022-24863 can lead to service outages by allowing an attacker to exhaust system memory.