CVE-2024-32971

{"id": "CVE-2024-32971", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2024-05-02T07:15:21.733", "references": [{"url": "https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529", "source": "security-advisories@github.com"}, {"url": "https://github.com/apollographql/router/releases/tag/v1.45.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v", "source": "security-advisories@github.com"}, {"url": "https://www.apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching", "source": "security-advisories@github.com"}, {"url": "https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/apollographql/router/releases/tag/v1.45.1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-440"}, {"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed which can result in unintended data or effects. This only affects Router instances configured to use distributed query plan caching. The root cause of this defect is a bug in Apollo Router\u2019s cache retrieval logic: When this defect is present and distributed query planning caching is enabled, asking the Router to execute an operation (whether it is a query, a mutation, or a subscription) may result in an unexpected variation of that operation being executed or the generation of unexpected errors. The issue stems from inadvertently executing a modified version of a previously executed operation, whose query plan is stored in the underlying cache (specifically, Redis). Depending on the type of the operation, the result may vary. For a query, results may be fetched that don\u2019t match what was requested (e.g., rather than running `fetchUsers(type: ENTERPRISE)` the Router may run `fetchUsers(type: TRIAL)`. For a mutation, this may result in incorrect mutations being sent to underlying subgraph servers (e.g., rather than sending `deleteUser(id: 10)` to a subgraph, the Router may run `deleteUser(id: 12)`. Users who are using distributed query plan caching, are advised to either upgrade to version 1.45.1 or above or downgrade to version 1.43.2 of the Apollo Router. Apollo Router versions 1.44.0 or 1.45.0 are not recommended for use and have been withdrawn. Users unable to upgrade can disable distributed query plan caching to mitigate this issue."}, {"lang": "es", "value": "Apollo Router es un router de gr\u00e1ficos configurable escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation 2. Las versiones afectadas de Apollo Router contienen un error que, en circunstancias limitadas, podr\u00eda provocar la ejecuci\u00f3n de operaciones inesperadas que pueden generar datos no deseados o efectos. Esto solo afecta a las instancias del router configuradas para utilizar el almacenamiento en cach\u00e9 del plan de consultas distribuidas. La causa principal de este defecto es un error en la l\u00f3gica de recuperaci\u00f3n de cach\u00e9 del router Apollo: cuando este defecto est\u00e1 presente y el almacenamiento en cach\u00e9 de planificaci\u00f3n de consultas distribuidas est\u00e1 habilitado, se solicita al router que ejecute una operaci\u00f3n (ya sea una consulta, una mutaci\u00f3n o una suscripci\u00f3n). puede resultar en una variaci\u00f3n inesperada de esa operaci\u00f3n que se ejecuta o en la generaci\u00f3n de errores inesperados. El problema surge de la ejecuci\u00f3n inadvertida de una versi\u00f3n modificada de una operaci\u00f3n ejecutada previamente, cuyo plan de consulta se almacena en la memoria cach\u00e9 subyacente (espec\u00edficamente, Redis). Dependiendo del tipo de operaci\u00f3n, el resultado puede variar. Para una consulta, es posible que se obtengan resultados que no coincidan con lo solicitado (por ejemplo, en lugar de ejecutar `fetchUsers(type: ENTERPRISE)`, el router puede ejecutar `fetchUsers(type: TRIAL)`. Para una mutaci\u00f3n, esto puede resultar en mutaciones incorrectas que se env\u00edan a servidores de subgrafos subyacentes (por ejemplo, en lugar de enviar `deleteUser(id: 10)` a un subgrafo, el router puede ejecutar `deleteUser(id: 12)`. Se recomienda a los usuarios que utilicen el almacenamiento en cach\u00e9 de planes de consulta distribuidos que actualicen a la versi\u00f3n 1.45.1 o superior, o bien que reduzcan a la versi\u00f3n 1.43.2 del router Apollo. No se recomienda el uso de las versiones 1.44.0 o 1.45.0 del router Apollo y se han retirado. Los usuarios que no puedan actualizar pueden desactivar el almacenamiento en cach\u00e9 del plan de consultas distribuidas para mitigar este problema."}], "lastModified": "2024-11-21T09:16:08.317", "sourceIdentifier": "security-advisories@github.com"}