Insecure storage of sensitive information in Apple Swift for Ubuntu
Priority LOW 25CWE-922Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-922.
Summary
This issue was addresses by updating incorrect URLSession file descriptors management logic to match Swift 5.0. This issue is fixed in Swift 5.1.1 for Ubuntu. Incorrect management of file descriptors in URLSession could lead to inadvertent data disclosure.
Why it matters now
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed Swift for Ubuntu (Apple): 5.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Swift for Ubuntu (Apple) Fixed in 5.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-8790
- 2026-10-03 Alias added: GHSA-5v59-m956-6fv5
References
Advisory 1
More Apple Swift vulnerabilities
- TI-2018-03175 Incorrect permission assignment in Apple Swift for Ubuntu CVSS 3.0HIGH 8.8
- TI-2020-07937 Uncontrolled recursion in Swift 5.1.5 for Linux CVSS 3.1HIGH 7.5
- TI-2022-01512 Incorrect type conversion in Apple Swift Corelib-Foundation CVSS 3.1HIGH 7.5
Sources
- CVE-2019-8790 · CVE Program
- CVE-2019-8790 · NVD
- FIRST EPSS
- GHSA-5v59-m956-6fv5 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-8790 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences