OPENSUSE-SU-2024:12794-1 ruby3.1-rubygem-grpc-1.52.0-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-grpc-1.52.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13391-1 grpc-devel-1.59.2-1.1 on GA media

These are all security issues fixed in the grpc-devel-1.59.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13621-1 grpc-devel-1.60.0-3.1 on GA media

These are all security issues fixed in the grpc-devel-1.60.0-3.1 package on the GA media of openSUSE Tumbleweed...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...

GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression

go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...

Denial Of Service (DoS)

github.com/klauspost/compress/zstd is vulnerable to a Denial of service DoS. The vulnerability is due to its zstd decompression implementation not respecting the limits imposed by gRPC, which allows attacker to trigger rapid and uncontrolled increases in memory usage on the server or client...

CVE-2024-5469

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469

Removed by vendor...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469

CVE-2024-5469 affects GitLab CE/EE KAS. A DoS via crafted gRPC requests crashes KAS, impacting all versions 16.10.0–16.10.5 and 16.11.0–16.11.2 (pre-16.10.6 and pre-16.11.3). Exploit details are not provided in the documents; no active exploit specifics are given here. Connected notes indicate Gi...

CVE-2024-5469: Improper Check for Unusual or Exceptional Conditions

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-37168

A flaw was found in grps-js, which implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channe...

Denial Of Service (DoS)

@grpc/grpc-js is vulnerable to Denial of Service DoS. The vulnerability is due to improper message size checks becauses messages that exceed the grpc.maxreceivemessagelength are buffered or decompressed in entirety before being discarded, which can result in DoS...

CVE-2024-37168

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: If an...

@a11ywatch/core (>=0.8.13, <=0.8.15), @a11ywatch/mav (>=0.7.17, <=0.7.27) +91 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.9.0, <=1.9.14)

@grpc/grpc-js NPM version =1.9.0, =0.8.13, =0.7.17, =0.9.42, =3.1.3, =0.61.0, =1.61.0, =0.2.2, =0.1.1, =0.0.5, =0.0.6, =0.0.8, =0.0.11, =0.0.5, =1.0.1, =7.1.3 and more Source cves: CVE-2024-37168 Source advisory: OSV:GHSA-7V5V-9H63-CJ86...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +4332 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.0.0, <=1.8.21)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2024-37168 Source advisory: OSV:GHSA-7V5V-9H63-CJ86...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +82 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.10.0, <=1.10.8)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =3.1.9, =0.78.0, =1.68.0, =8.5.1-alpha.4, =3.5.2, =17.8.3, =0.0.1-hw-fix-code-nightly-gha.29105, =0.1.5-hw-fix-code-nightly-gha.29105, =0.1.5-pd-ent-755-gha.29158 and more Source cves: CVE-2024-37168 Source advisory:...

GHSA-7V5V-9H63-CJ86 @grpc/grpc-js can allocate memory for incoming messages well above configured limits

Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an...