GHSA-frg3-gpcx-968f

SwiftNIO SSL arbitrary code execution vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-8849

Packages

Ecosystem	Package	Affected	Fixed in
SwiftURL	github.com/apple/swift-nio-ssl	>= 2.0.0, < 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-8849 advisory
https://github.com/apple/swift-nio-ssl/commit/109faef770994e71b6bafcc015e2e96b88a4af8c web
https://github.com/apple/swift-nio-ssl package
https://github.com/apple/swift-nio-ssl/releases/tag/2.4.1 web
https://security.snyk.io/vuln/SNYK-COCOAPODS-SWIFTNIOSSL-8492737 web
https://support.apple.com/HT210772 web