Security Exception in graphql-java
Summary
OSV-2024-359: Security exception in graphql.schema.GraphQLTypeUtil.simplePrint. Affects graphql-java versions >= f52305325593dcec70aba9c4a5717b18b6543fa0, < d6dbf6156e8a90a1420a7cee957de0b22100d47f. Fixed in d6dbf6156e8a90a1420a7cee957de0b22100d47f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The graphql-java package is an open-source library that provides a Java implementation of the GraphQL specification. It allows developers to build and execute GraphQL queries and mutations in Java applications. The package is widely used in various projects and provides a comprehensive set of tools and utilities for working with GraphQL schemas and types.
Vulnerability Detail
The security exception in the graphql.schema.GraphQLTypeUtil.simplePrint function can lead to a crash in the application. This vulnerability was reported through the OSS-Fuzz project and is caused by a security exception in the mentioned function. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or execute arbitrary code. The vulnerability has a low severity rating.
How To Fix
Minimum fixed version
d6dbf6156e8a90a1420a7cee957de0b22100d47f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to the fixed version.
Conclusion
The security exception in the graphql-java package's simplePrint function can lead to a crash in the application. It is recommended to update the package to the fixed version to mitigate the vulnerability.
See every vulnerability recorded for graphql-java →
FAQ
graphql-java is an open-source library that provides a Java implementation of the GraphQL specification. It allows developers to build and execute GraphQL queries and mutations in Java applications.
The vulnerability can lead to a crash in the application, potentially causing a denial-of-service (DoS) attack or enabling the execution of arbitrary code.
To fix this vulnerability, update your graphql-java package to a version that includes the fix. Modify your project's dependency configuration to use the fixed version.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended approach.
The vulnerability has a low severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphql-java.
