{"answers":{"affected":"2 open source packages ship an affected version, including apollo-router. It affects 2 products.","exploited":"There is no known exploitation of CVE-2023-45812 in the wild and no public exploit code.","fix":"Upgrade apollo-router to 1.33.0 or later.","what":"CVE-2023-45812 is a high-severity denial of service vulnerability in apollographql router, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-45812 and fix it if it is affected.\n\nWhat it is: CVE-2023-45812 is a high-severity denial of service vulnerability in apollographql router, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-45812 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- apollo-router (crates.io): affected from 1.31.0; fixed in 1.33.0\n- apollo-router (crates.io): affected from 1.31.0; fixed in 1.33.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-45812/ (Markdown: https://insights.sbomify.com/CVE-2023-45812/index.md)","id":"CVE-2023-45812","markdown":"https://insights.sbomify.com/CVE-2023-45812/index.md","name":"CVE-2023-45812","record":{"aliases":["GHSA-r344-xw3p-2frj"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Apollo Router","requires_auth":"none","summary":"Attackers can cause the Apollo Router to panic and terminate by sending specific queries when a coprocessor is configured.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"apollo_helms-charts_router","vendor":"apollographql"},{"product":"apollo_router","vendor":"apollographql"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-754","name":"Improper Check for Unusual or Exceptional Conditions"}],"description":"The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Improper Check or Handling of Exceptional Conditions in apollo-router","id":"CVE-2023-45812","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":2,"n_references":2,"next":{"headline":"Inefficient Regular Expression Complexity in TorBot","id":"CVE-2023-45813"},"packages":[{"ecosystem":"crates.io","fixed":["1.33.0"],"introduced":["1.31.0"],"last_affected":[],"package":"apollo-router","purl":null,"source":"GHSA-r344-xw3p-2frj"},{"ecosystem":"crates.io","fixed":["1.33.0"],"introduced":["1.31.0"],"last_affected":[],"package":"apollo-router","purl":"pkg:cargo/apollo-router","source":"GHSA-r344-xw3p-2frj"}],"prev":{"headline":"Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator","id":"CVE-2023-45811"},"products":["router"],"published":"2023-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-13","vendors":["apollographql"]},"summary":"Attackers can cause the Apollo Router to panic and terminate by sending specific queries when a coprocessor is configured.","url":"https://insights.sbomify.com/CVE-2023-45812/"}