GoogleOSV:GHSA-9HXF-PPJV-W6RQgRPC connection termination issue
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0.001 Low
EPSS
Percentile
34.9%
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
References
github.com/grpc/grpc/pull/32309
github.com/grpc/grpc/releases/tag/v1.53.1
github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32732.yml
lists.fedoraproject.org/archives/list/[email protected]/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY
lists.fedoraproject.org/archives/list/[email protected]/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL
nvd.nist.gov/vuln/detail/CVE-2023-32732
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0.001 Low
EPSS
Percentile
34.9%