{"answers":{"affected":"2 open source packages ship an affected version, including github.com/apple/swift-corelibs-foundation. It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-1642 in the wild and no public exploit code.","fix":"Upgrade github.com/apple/swift-corelibs-foundation to 5.6.2 or later.","what":"CVE-2022-1642 is a high-severity denial of service vulnerability in Swift Corelib-Foundation, published on 16 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-1642 and fix it if it is affected.\n\nWhat it is: CVE-2022-1642 is a high-severity denial of service vulnerability in Swift Corelib-Foundation, published on 16 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-1642 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/apple/swift-corelibs-foundation (SwiftURL): affected all versions; fixed in 5.6.2\n- github.com/apple/swift-corelibs-foundation (SwiftURL): affected all versions; fixed in 5.6.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-1642/ (Markdown: https://insights.sbomify.com/CVE-2022-1642/index.md)","id":"CVE-2022-1642","markdown":"https://insights.sbomify.com/CVE-2022-1642/index.md","name":"CVE-2022-1642","record":{"aliases":["GHSA-239c-6cv2-wwx8"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Swift Foundation library","requires_auth":"none","summary":"Attackers can crash Swift applications by sending crafted JSON with type mismatches, causing denial of service in services using JSONDecoder.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Swift","cpe":[{"product":"swift","vendor":"apple"}],"cvss":{"score":7.5,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-704","name":"Incorrect Type Conversion or Cast"},{"id":"CWE-351","name":"Insufficient Type Distinction"},{"id":"CWE-241","name":"Improper Handling of Unexpected Data Type"}],"description":"A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard library, the Codable protocol; and the JSONDecoder class offered by swift-corelibs-foundation, which can deserialize types that adopt the Codable protocol based on the content of a provided JSON document. When a type that adopts Codable requests the initialization of a field with an integer value, the JSONDecoder class uses a type-erased container with different accessor methods to attempt and coerce a corresponding JSON value and produce an integer. In the case the JSON value was a numeric literal with a floating-point portion, JSONDecoder used different type-eraser methods during validation than it did during the final casting of the value. The checked casting produces a deterministic crash due to this mismatch. The JSONDecoder class is often wrapped by popular Swift-based web frameworks to parse the body of HTTP requests and perform basic type validation. This makes the attack low-effort: sending a specifically crafted JSON document during a request to these endpoints will cause them to crash. The attack does not have any confidentiality or integrity risks in and of itself; the crash is produced deterministically by an abort function that ensures that execution does not continue in the face of this violation of assumptions. However, unexpected crashes can lead to violations of invariants in services, so it's possible that this attack can be used to trigger error conditions that escalate the risk. Producing a denial of service may also be the goal of an attacker in itself. This issue is solved in Swift 5.6.2 for Linux and Windows. This issue was solved by ensuring that the same methods are invoked both when validating and during casting, so that no type mismatch occurs. Swift for Linux and Windows versions are not ABI-interchangeable. To upgrade a service, its owner must update to this version of the Swift toolchain, then recompile and redeploy their software. The new version of Swift includes an updated swift-corelibs-foundation package. Versions of Swift running on Darwin-based operating systems are not affected.","ecosystems":["SwiftURL"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder","id":"CVE-2022-1642","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"SwiftURL","product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":2,"n_references":1,"next":{"headline":"Birthdays Widget \u003c= 1.7.18 - Admin+ Stored Cross Site Scripting","id":"CVE-2022-1643"},"packages":[{"ecosystem":"SwiftURL","fixed":["5.6.2"],"introduced":["0"],"last_affected":[],"package":"github.com/apple/swift-corelibs-foundation","purl":null,"source":"GHSA-239c-6cv2-wwx8"},{"ecosystem":"SwiftURL","fixed":["5.6.2"],"introduced":["0"],"last_affected":[],"package":"github.com/apple/swift-corelibs-foundation","purl":"pkg:swift/github.com/apple/swift-corelibs-foundation","source":"GHSA-239c-6cv2-wwx8"}],"prev":{"headline":"Use after free in Chrome","id":"CVE-2022-1641"},"products":["Swift Corelib-Foundation"],"published":"2022-06-16","related":[{"cvss_score":8.8,"headline":"Privilege escalation in n/a","id":"CVE-2018-4220","kev_date_added":null,"published":"2018-06-08"},{"cvss_score":7.5,"headline":"Denial of service in Swift 5.1.5 for Linux","id":"CVE-2020-9861","kev_date_added":null,"published":"2020-11-02"},{"cvss_score":5.5,"headline":"Information disclosure in Swift for Ubuntu","id":"CVE-2019-8790","kev_date_added":null,"published":"2020-10-27"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["Swift Project"]},"summary":"Attackers can crash Swift applications by sending crafted JSON with type mismatches, causing denial of service in services using JSONDecoder.","url":"https://insights.sbomify.com/CVE-2022-1642/"}