crates.io/apollo-router: medium
Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery
Action: Upgrade apollo-router to 1.61.13 or later.
cargo update -p apollo-router --precise 2.12.1cargo update -p apollo-router --precise 2.10.2cargo update -p apollo-router --precise 1.61.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.11.0 | 2.12.1 | - |
| 2.0.0 | 2.10.2 | - |
| 0 | 1.61.13 | - |
Fixed versions
| 2.12.1 | 2.10.2 | 1.61.13 |
Sources
- osv: GHSA-hff2-gcpx-8f4p
- https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h
- https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p
- https://github.com/apollographql/router/commit/a72e759bcdeef93fcd3dc928cf3c1f4bbebdcc65
- https://github.com/apollographql/router
- https://github.com/apollographql/router/releases/tag/v2.12.1
- https://www.apollographql.com/docs/graphos/resources/runtime-release-lifecycle#end-of-support-eos
published · modified · JSON