edu.gemini:gsp-graphql-circe_native0.4_2.13 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_native0.4_2.13 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_native0.4_2.13 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-corenative0.42.13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

edu.gemini:benchmark_3 (>=0.1, <=0.2), edu.gemini:benchmarks_3 (>=0.1.8, <=0.1.16) +9 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_3 (>=0.0.47, <=0.14.0)

edu.gemini:gsp-graphql-core3 MAVEN version =0.0.47, =0.1, =0.1.8, =0.0.47, =0.5.0, =0.0.47, =0.0.48, =0.0.47, =0.0.47, =0.3.3, =0.1, =0.20.3 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_native0.4_3 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_native0.4_3 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_native0.4_3 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-corenative0.43 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

Grackle has StackOverflowError in GraphQL query processing

Impact Prior to this fix, the GraphQL query parsing was vulnerable to StackOverflowErrors. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. !CAUTION No...

edu.gemini:lucuma-graphql-routes_3 (>=0.8.0, <=0.8.5), edu.gemini:lucuma-itc-service_3 (>=0.21.0, <=0.21.3) +5 more potentially affected by CVE-2023-50730 via org.typelevel:grackle-core_3 (>=0.15.0, <=0.17.2)

org.typelevel:grackle-core3 MAVEN version =0.15.0, =0.8.0, =0.21.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.17.2 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_native0.4_2.13 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_native0.4_2.13 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_native0.4_2.13 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-corenative0.42.13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_native0.4_3 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_native0.4_3 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_native0.4_3 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-corenative0.43 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

edu.gemini:benchmarks_2.13 (>=0.1.8, <=0.1.16), edu.gemini:clue-generator_2.13 (>=0.12.0, <=0.35.4) +10 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_2.13 (>=0.0.1, <=0.14.0)

edu.gemini:gsp-graphql-core2.13 MAVEN version =0.0.1, =0.1.8, =0.12.0, =0.2.2, =0.0.18, =0.0.1, =0.5.0, =0.0.1, =0.0.2, =0.0.26, =0.0.26, =0.1.1, =0.6.6 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_sjs1_3 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_sjs1_3 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_sjs1_3 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-coresjs13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_sjs1_2.13 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_sjs1_2.13 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_sjs1_2.13 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-coresjs12.13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

edu.gemini:lucuma-graphql-routes_3 (>=0.8.0, <=0.8.5), edu.gemini:lucuma-itc-service_3 (>=0.21.0, <=0.21.3) +5 more potentially affected by CVE-2023-50730 via org.typelevel:grackle-core_3 (>=0.15.0, <=0.17.2)

org.typelevel:grackle-core3 MAVEN version =0.15.0, =0.8.0, =0.21.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.17.2 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_sjs1_2.13 (>=0.13.0, <=0.14.0), edu.gemini:gsp-graphql-generic_sjs1_2.13 (>=0.13.0, <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_sjs1_2.13 (>=0.13.0, <=0.14.0)

edu.gemini:gsp-graphql-coresjs12.13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:benchmark_3 (>=0.1, <=0.2), edu.gemini:benchmarks_3 (>=0.1.8, <=0.1.16) +9 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_3 (>=0.0.47, <=0.14.0)

edu.gemini:gsp-graphql-core3 MAVEN version =0.0.47, =0.1, =0.1.8, =0.0.47, =0.5.0, =0.0.47, =0.0.48, =0.0.47, =0.0.47, =0.3.3, =0.1, =0.20.3 Source cves: CVE-2023-50730 Source advisory: GHSA-G56X-7J6W-G8R8...

@graphql-inspector/action (>=3.4.2, <=5.0.4), release-drafter-github-app (>=5.16.0, <=6.4.0) potentially affected by CVE-2023-50728 via probot (>=12.2.0, <=12.3.1)

probot NPM version =12.2.0, =3.4.2, =5.16.0, =6.4.0 Source cves: CVE-2023-50728 Source advisory: OSV:GHSA-PWFR-8PQ7-X9QV...

@graphql-inspector/action (>=3.4.2, <=5.0.4), release-drafter-github-app (>=5.16.0, <=6.4.0) potentially affected by CVE-2023-50728 via probot (>=12.2.0, <=12.3.1)

probot NPM version =12.2.0, =3.4.2, =5.16.0, =6.4.0 Source cves: CVE-2023-50728 Source advisory: GHSA-PWFR-8PQ7-X9QV...

Authorization Bypass

quarkus-smallrye-graphql is vulnerable to Authorization Bypass. The vulnerability is due to doHandle function in SmallRyeGraphQLOverWebSocketHandler.java file there are no checks to ensure that the user is authenticated or authorized to access the GraphQL endpoint. This allows an attacker to acce...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

Authorization bypass in Quarkus

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...