CVE-2022-1642 — Improper Handling of Unexpected Data Type in Project Swift Corelib-foundation

CWE-241 — Improper Handling of Unexpected Data TypeCWE-351 — Insufficient Type DistinctionCWE-704 — Incorrect Type Conversion or CastCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
7.5HIGHNVD
CISA7.8
EPSS
0.2%
top 55.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Swift Project Swift Corelib-foundationApple SwiftGithub.com Apple Swift-corelibs-foundation
Timeline
PublishedJun 16
Latest updateJun 7

Description

A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard library, the Codable protocol; and the JSONDecoder class offered by swift-corelibs-foundation, which can deserialize types that adopt the Codable protocol based on the content of a provided JSON document. …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5swift_project/swift_corelib-foundation5.5.0 — unspecified+1
▶NVDapple/swift< 5.6.2

🔴Vulnerability Details

3
OSV
Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder↗2023-06-07
▶
GHSA
Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder↗2023-06-07
▶
CVEList
CVE-2022-1642: A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON docume↗2022-06-16
▶

📋Vendor Advisories

1
CISA
Microsoft Office Memory Corruption Vulnerability↗2022-03-03
▶

📐Framework References

1
OWASP
Mastg Demo 0052↗
▶
CVE-2022-1642 — HIGH severity | cvebase