1306 matches found
CVE-2024-43414
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1...
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Impact Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1 are also impacted through their use of @apollo/query-planner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded...
@genesisx/graphql (>=3.0.0-beta.1, <=4.0.1), @genesisx/graphql-utils (>=3.0.0-beta.0, <=3.0.1) +9 more potentially affected by CVE-2024-43414 via @apollo/gateway (>=2.0.0-preview.2, <=2.8.4)
@apollo/gateway NPM version =2.0.0-preview.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.11.46-alpha-bad726532.0, =0.0.1, =8.6.7, =2.8.54, =0.0.0-preview-20220428090254, =0.0.0-preview-20221125005457, =1.3.3, =0.0.3, =1.0.48 - nestjs-registry 0.0.1 Source cves: CVE-2024-43414 Source advisory:...
@apollo/gateway (>=2.3.0-beta.2, <=2.8.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2024-43414 via @apollo/query-planner (>=2.3.0, <=2.8.4)
@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2024-43414 Source advisory: OSV:GHSA-FMJ9-77Q8-G6C4...
GHSA-FMJ9-77Q8-G6C4 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Impact Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1 are also impacted through their use of @apollo/query-planner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded...
CVE-2024-43414 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1...
CVE-2024-43414
CVE-2024-43414 affects Apollo Federation components: @apollo/query-planner (v2.0.0–=2.0.0 and <2.8.5) and Apollo Router (
CVE-2024-43414 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1...
CVE-2024-43414 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1...
Apollo Federation 安全漏洞
Apollo Federation is an architecture for the Apollo community to declaratively combine APIs into a unified graph. A security vulnerability exists in Apollo Federation, which stems from the fact that if @apollo/query-planner is asked to plan a sufficiently complex query, it may loop indefinitely a...
PT-2024-30572 · Apollo · Apollo Gateway +2
Name of the Vulnerable Software and Affected Versions: @apollo/query-planner versions 2.0.0 through 2.8.4 @apollo/gateway versions 2.0.0 through 2.8.4 Apollo Router versions prior to 1.52.1 Description: The issue is a denial-of-service vulnerability that can cause the Apollo query planner to loop...
CVE-2024-42347
Affects matrix-react-sdk (Matrix web client component). A malicious homeserver could manipulate a user’s account data to enable URL previews in end-to-end encrypted rooms, causing URLs from encrypted messages to be sent to the server. This is mitigated by upgrading to matrix-react-sdk version 3.1...
CVE-2024-6301
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs...
CVE-2024-6301 Origin Validation Error in Conduit
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs...
CVE-2024-6301 Origin Validation Error in Conduit
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs...
CVE-2024-6301 Origin Validation Error in Conduit
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs...
CVE-2024-6301
Conduit (federation API) is affected by CVE-2024-6301: lack of origin validation in the federation API allows any remote server to impersonate any user from any server in most EDUs. The vulnerability affects Conduit versions prior to 0.8.0. Root cause: insufficient validation of origin in federat...
Malicious code in apollo-federation-integration-testsuite (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-1763 Malicious code in apollo-federation-integration-testsuite (npm)
--- -= Per source details. Do not edit below this line.=-...
PT-2024-37523 · Conduit · Conduit
Name of the Vulnerable Software and Affected Versions: Conduit affected versions not specified Description: The issue is related to a lack of validation of origin in the federation API in Conduit. This allows any remote server to impersonate any user from any server in most EDUs. Recommendations:...