CVE-2023-33953

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...

Excessive Iteration in gRPC

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...

Important: grpc

Issue Overview: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and...

PT-2023-24594

Name of the Vulnerable Software and Affected Versions gRPC affected versions not specified Description The issue allows hpack table accounting errors, which could lead to unwanted disconnects between clients and servers in exceptional cases. Three vectors were found that allow the following DOS...

CVE-2023-33953: Excessive Iteration

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...

Moderate Photon OS Security Update - PHSA-2023-5.0-0068

Updates of 'grpc' packages of Photon OS have been released...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in gRPC

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of gRPC. Vulnerability Details CVEID:CVE-2023-32732 DESCRIPTION: gRPC is vulnerable to a denial of service, caused by a base64 encoding error for "-bin" suffixed headers. By sending a specially crafted...

Denial Of Service (DoS)

github.com/envoyproxy/envoy is vulnerable to Denial of Service DoS attacks. When the listener is exhausted, gRPC access logs utilizing its global scope may result in a use-after-free, which allows an authenticated attacker to cause an application crash via a malicious LDS upstream...

CVE-2023-35942

A flaw was found in Envoy, where gRPC access loggers using the listener's global scope can cause a use-after-free crash when the listener is drained. This issue can be triggered by a listener discovery service LDS update with the same gRPC access log configuration...

Fedora: Security Advisory for grpc (FEDORA-2023-15b3e80753)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for grpc (FEDORA-2023-6cad6e5003)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-35942

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a use-after-free crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9,...

Design/Logic Flaw

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a use-after-free crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9,...

com.linecorp.armeria:armeria-grpc (0.66.0), com.linecorp.armeria:armeria-jetty (0.66.0) +16 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.66.0)

com.linecorp.armeria:armeria MAVEN version 0.66.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.66.0 - com.linecorp.armeria:armeria-jetty 0.66.0 -...

com.linecorp.armeria:armeria-grpc (0.59.1), com.linecorp.armeria:armeria-jetty (0.59.1) +12 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.59.1)

com.linecorp.armeria:armeria MAVEN version 0.59.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.59.1 - com.linecorp.armeria:armeria-jetty 0.59.1 -...

com.linecorp.armeria:armeria-grpc (0.32.0), com.linecorp.armeria:armeria-jetty (0.32.0) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.32.0)

com.linecorp.armeria:armeria MAVEN version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.32.0 - com.linecorp.armeria:armeria-jetty 0.32.0 -...

com.linecorp.armeria:armeria-grpc (0.33.0), com.linecorp.armeria:armeria-jetty (0.33.0) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.33.0)

com.linecorp.armeria:armeria MAVEN version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.33.0 - com.linecorp.armeria:armeria-jetty 0.33.0 -...

com.linecorp.armeria:armeria-grpc (0.36.0), com.linecorp.armeria:armeria-jetty (0.36.0) +7 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.36.0)

com.linecorp.armeria:armeria MAVEN version 0.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.36.0 - com.linecorp.armeria:armeria-jetty 0.36.0 -...

com.linecorp.armeria:armeria-grpc (0.35.0), com.linecorp.armeria:armeria-jetty (0.35.0) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.35.0)

com.linecorp.armeria:armeria MAVEN version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.35.0 - com.linecorp.armeria:armeria-jetty 0.35.0 -...

com.linecorp.armeria:armeria-grpc (0.35.2), com.linecorp.armeria:armeria-jetty (0.35.2) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.35.2)

com.linecorp.armeria:armeria MAVEN version 0.35.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.35.2 - com.linecorp.armeria:armeria-jetty 0.35.2 -...