CVE-2023-32688: Invalid push request payload crashes Parse Server
Impact
The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.
Patches
Invalid push notification payload is caught and an logged.
Workarounds n/a
References - https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993 - https://github.com/parse-community/parse-server-push-adapter/pull/217
Other sources
parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-32688?
The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.
How do I fix CVE-2023-32688?
Update to version 4.1.3 of the parse-server-push-adapter package.
Are there any workarounds for CVE-2023-32688?
No, there are no workarounds available.
Where can I find more information about CVE-2023-32688?
You can find more information about CVE-2023-32688 at the following references: - [GitHub Advisory](https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993) - [GitHub Pull Request](https://github.com/parse-community/parse-server-push-adapter/pull/217) - [GitHub Release](https://github.com/parse-community/parse-server-push-adapter/releases/tag/4.1.3)