gRPC 安全漏洞

🗓️ 09 Jun 2023 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

Rpc framework header size error desynchronizes compression, risking disclosure and privilege escalation.

Reporter	Title	Published	Views	Family All 59
IBM Security Bulletins	Security Bulletin: Vulnerabilities in gRPC affect watsonx.data	25 Sep 202419:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator	28 Aug 202308:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server	14 Dec 202321:06	–	ibm
IBM Security Bulletins	Security Bulletin: gRPC HTTP/2 HPACK Desynchronization Vulnerability Allowing Header Leakage and Privilege Escalation, affects watsonx.data	4 Dec 202508:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436	21 Oct 202414:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2023-32731 CVE-2023-32732)	21 Nov 202512:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in gRPC	27 Jul 202322:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 which is shipped with IBM Intelligent Operations Center.	18 Dec 202308:12	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in gRPC may affect IBM Robotic Process Automation and result in an attacker obtaining sensitive information. (CVE-2023-32731)	20 Sep 202314:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Db2 affect Cloud Pak System	28 Oct 202416:03	–	ibm

Source	Link
github	www.github.com/grpc/grpc/pull/33005
github	www.github.com/grpc/grpc/pull/32309
cxsecurity	www.cxsecurity.com/cveshow/CVE-2023-32731/
access	www.access.redhat.com/security/cve/cve-2023-32731
auscert	www.auscert.org.au/bulletins/ESB-2023.7226
auscert	www.auscert.org.au/bulletins/ESB-2023.5125

20 Feb 2026 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.4 - 7.5

EPSS0.00075

SSVC

rpc framework header compression scheme header table desynchronization information disclosure privilege escalation http protocol two