Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

K000141352: Multiple gRPC vulnerabilities

🗓️ 07 Oct 2024 02:53:25Reported by f5Type 
f5
 f5🔗 my.f5.com👁 14 Views

gRPC vulnerabilities in versions before 1.24.4 and @grpc/grpc-js before 1.1.8, leading to Prototype Pollution, heap-based buffer overflows, and use-after-free vulnerabilitie

Related
ReporterTitlePublishedViews
Family
Huntr		Prototype Pollution in grpc/grpc-node
26 Jan 202100:00
–huntr
IBM Security Bulletins		Security Bulletin: App Connect Enterprise Certified Container is vulnerable to code injection and Denial of Service attacks
10 Dec 202014:33
–ibm
IBM Security Bulletins		Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to prototype pollution due to the gRPC package ( CVE-2020-7768)
23 Jul 202516:13
–ibm
IBM Security Bulletins		Security Bulletin: IBM Security Verify Information Queue uses a Google gRPC framework with multiple vulnerabilities (CVE-2017-7860, CVE-2017-7861, CVE-2017-9431)
20 Jul 202219:27
–ibm
IBM Security Bulletins		Security Bulletin: Multiple Vulnerabilities in Java and Node.js packages affect IBM Voice Gateway
11 Jan 202318:41
–ibm
BDU FSTEC		The vulnerability in the `core/lib/iomgr/error.c` file of the Google GRPC system, related to out-of-buffer writing, allows a attacker to cause memory corruption and execute arbitrary code.
2 Aug 202200:00
–bdu_fstec
BDU FSTEC		The vulnerability of the gpr_free function in the core/lib/support/alloc.c of the Google GRPC remote procedure call system, related to out-of-buffer writing, allows a attacker to cause memory corruption and execute arbitrary code.
2 Aug 202200:00
–bdu_fstec
BDU FSTEC		The vulnerability of the `parse_unix` function in the `core/ext/client_channel/parse_address.c` file of the Google GRPC remote procedure call system, related to writing beyond buffer boundaries, allows a attacker to trigger a memory corruption and execute arbitrary code.
2 Aug 202200:00
–bdu_fstec
CNVD		Google gRPC heap buffer overflow vulnerability (CNVD-2017-06015)
20 Apr 201700:00
–cnvd
CNVD		Google gRPC Heap Buffer Overflow Vulnerability
20 Apr 201700:00
–cnvd
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
07 Oct 2024 02:53Current
8.9High risk
Vulners AI Score8.9
CVSS 27.5
CVSS 39.8
CVSS 3.17.5 - 9.8
EPSS0.03554
grpcvulnerabilitiesprototype pollutionbuffer overflowuse-after-free
14