CVE-2023-45812: Improper Check or Handling of Exceptional Conditions in apollo-router
Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the @defer or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions.
Patches Router version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue.
Workarounds For affected versions, avoid using the coprocessor supergraph response: yml do not use this stage in your coprocessor configuration coprocessor: supergraph: response:
Or you can disable defer and subscriptions support: yml disable defer and subscriptions: supergraph: defersupport: false # enabled by default subscription: enabled: false # disabled by default and continue to use the coprocessor supergraph response. References https://github.com/apollographql/router/issues/4013
Other sources
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the @defer or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-45812?
CVE-2023-45812 is a vulnerability in the Apollo Router that can cause a Denial-of-Service (DoS) by panicking and terminating the Router when a multi-part response is received.
What is the impact of CVE-2023-45812?
The impact of CVE-2023-45812 is a Denial-of-Service (DoS) vulnerability in the Apollo Router that can cause the Router to panic and terminate.
What is the severity of CVE-2023-45812?
CVE-2023-45812 has a severity rating of high.
How can I fix CVE-2023-45812?
To fix CVE-2023-45812, update the Apollo Router to version 1.33.0 or apply the available remedy.
Where can I find more information about CVE-2023-45812?
You can find more information about CVE-2023-45812 in the following references: [Advisory](https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-45812), [GitHub Issue](https://github.com/apollographql/router/issues/4013).