CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886: Improper Authentication

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

grpc/api_fuzzer: Heap-use-after-free in grpc_core::channelz::CallCountingHelper::RecordCallFailed

Detailed report: https://oss-fuzz.com/testcase?key=5717773926268928 Project: grpc Fuzzer: libFuzzerapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60e0000012d0 Crash State:...

Happy graduation, Envoy!

Envoy, the new darling of the DevOps community, performs the role of a service and edge proxy. With advanced features such as timeouts, rate limiting, circuit breaking, load balancing, retries, stats, logging, and distributed tracing are required to handle network failures in a fault tolerant and...

PT-2018-2974 · Coreos +2 · Etcd +2

Name of the Vulnerable Software and Affected Versions: etcd versions 3.2.x through 3.2.25 etcd versions 3.3.x through 3.3.10 Description: The issue concerns an improper authentication problem when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS...

FreeBSD : Gitlab -- multiple vulnerabilities (065b3b72-c5ab-11e8-9ae2-001b217b3468)

Gitlab reports : SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket ======================= BUG DESCRIPTION ======================= There is a variety of RPC communication channels between the Chrome OS host system and the crosvm guest. This bug report focuses on communication on TCP port 8889...

Chrome OS 10820.0.0 dev-channel - app->VM via garcon TCP Command Socket

======================= BUG DESCRIPTION ======================= There is a variety of RPC communication channels between the Chrome OS host system and the crosvm guest. This bug report focuses on communication on TCP port 8889, which is used by the "garcon" service. Among other things, garcon is...

grpc/api_fuzzer: Crash in gpr_strdup

Detailed report: https://oss-fuzz.com/testcase?key=5406804084260864 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fff00000000 Crash State: gprstrdup getdefaultauthority...

Information Disclosure Through C Format String

grpc is vulnerable to information disclosure through a C Format String vulnerability. The vulnerability exists as the %s string format is not specified, potentially allowing other data to be read, and in some cases causes the application to crash...

WS-2018-0609

In gRPC v1.10.0-pre1 to 1.10.1 “rbcompressionoptions” ruby extension is vulnerable to a format string attack that could lead to information disclosure and denial of service...

grpc/api_fuzzer: Heap-use-after-free in gpr_mpscq_pop_and_check_end

Detailed report: https://oss-fuzz.com/testcase?key=5118480400515072 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x629000008a10 Crash State: gprmpscqpopandcheckend...

Design/Logic Flaw

A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition when the emsd service stops. The vulnerability is due to the software's inability to...

CVE-2017-12270

A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition when the emsd service stops. The vulnerability is due to the software's inability to...

CVE-2017-12270

CVE-2017-12270 affects Cisco IOS XR Software on Cisco NCS 5500 Series Routers. The vulnerability lies in the gRPC code’s handling of HTTP/2 packets, specifically an inability to properly process malformed HTTP/2 frames, which can be exploited by an unauthenticated remote attacker to cause a denia...

CVE-2017-12270: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition when the emsd service stops. The vulnerability is due to the software's inability to...

Cisco IOS XR Software Denial of Service Vulnerability

A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition when the emsd service stops. The vulnerability is due to the software's inability to...

PT-2017-12445

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers affected versions not specified Description A vulnerability in the gRPC code could allow an unauthenticated, remote attacker to cause a denial of service DoS...