CVE-2023-0296

Technical details for CVE-2023-0296 are not provided in the supplied documents. No affected products, root cause, or remediation specifics are present here. Monitor for updates in connected feeds to obtain concrete information.

CVE-2023-0296: Use of a Broken or Risky Cryptographic Algorithm

The Birthday attack against 64-bit block ciphers flaw CVE-2016-2183 was reported for the health checks port 9979 on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port...

CVE-2023-0296

The Birthday attack against 64-bit block ciphers CVE-2016-2183 was reported for the health checks port 9979 on the etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port...

ETCD encryption-related vulnerabilities

etcd is a key-value storage system for distributed systems written in the Go language. A cryptographic issue vulnerability exists in etcd grpc-proxy, which stems from the presence of a 64-bit block cipher attack...

PT-2023-5866

Name of the Vulnerable Software and Affected Versions HTTP/2 protocol affected versions not specified Description This protocol-level issue allows remote attackers to cause a denial of service DoS by exhausting server resources. The flaw stems from the HTTP/2 multiplexing feature, which allows...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), com.google.protobuf:protobuf-kotlin-lite (>=3.21.0, <=3.21.6) +12 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.21.0, <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0, =3.21.0, =2.15.0, =2.15.0, =0.4.6, =0.4.6, =0.4.6, =0.4.6, =7.3.0, =7.3.0, =0.3.1, =0.3.5, =1.48.0, =1.49.1 Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

This Week in Spring - December 6th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? You know what Ive wanted to do? See my friends on the Spring team in person since the pandemic descended. And, Im overjoyed to relate, Ive just had the privilege of a nice meeting with several of them last night...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-41911 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-41911 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-41900 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-41900 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-41897 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-41897 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-41887 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-41887 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-41886 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-41886 Source...

Denial of Service (DoS)

Overview grpc/grpc-swift is a Swift language implementation of gRPC. Affected versions of this package are vulnerable to Denial of Service DoS. Excessive memory may be allocated when parsing messages. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

grpc-go:fuzz_helloserver: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6289361436278784 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloserver Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

Uncontrolled Recursion

Overview grpc/grpc-swift is a Swift language implementation of gRPC. Affected versions of this package are vulnerable to Uncontrolled Recursion when parsing certain payloads. This can lead to a Denial-of-Service. Remediation Upgrade grpc/grpc-swift to version 1.2.0 or higher. References - GitHub...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), com.google.protobuf:protobuf-kotlin-lite (>=3.21.0-rc-1, <=3.21.6) +12 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.21.0-rc-1, <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0-rc-1, =3.21.0-rc-1, =2.15.0, =2.15.0, =0.4.6, =0.4.6, =0.4.6, =0.4.6, =7.3.0, =7.3.0, =0.3.1, =0.3.5, =1.48.0, =1.49.1 Source cves: CVE-2022-3171 Source advisory: MEND:CVE-2022-3171...

com.jamshedalamqaderi.ktransport:generate-proto (>=0.0.1-dev-17, <=1.0.6), com.wavesenterprise:we-contract-sdk-grpc (>=1.0.0, <=1.2.0) +7 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin (3.20.1)

com.google.protobuf:protobuf-kotlin MAVEN version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin and may be impacted: - com.jamshedalamqaderi.ktransport:generate-proto =0.0.1-dev-17, =1.0.0, =0.2.0, =0.2.0,...

envoy:server_fuzz_test: Container-overflow in std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=4906963556761600 Project: envoy Fuzzing Engine: honggfuzz Fuzz Target: serverfuzztest Job Type: honggfuzzasanenvoy Platform Id: linux Crash Type: Container-overflow READ Crash Address: 0x6080001e19...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-35983 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-35983 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-35988 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-35988 Source...