CVE-2021-32742 HIGH

CVE-2021-32742: Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

Vendor Vapor
Product vapor
Weakness CWE-502 · Unsafe deserialization
Published July 9, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.

Key dates

02Disclosure timeline

July 9, 2021 CVE published
August 3, 2024 Record updated