[SECURITY] Fedora 35 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-3.fc35

GRPC to JSON proxy generator following the gRPC HTTP spec...

go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

GHSA-H6XX-PMXH-3WGP go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

grpc-go:fuzz_helloclient: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4632082384551936 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloclient Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN...

Denial of Service (DoS)

Overview grpc/grpc-swift is a Swift language implementation of gRPC. Affected versions of this package are vulnerable to Denial of Service DoS via reachable assertion, due to an incorrect logic when handling GOAWAY frames. Details Denial of Service DoS describes a family of attacks, all aimed at...

CVE-2022-24777

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

Code injection

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777

CVE-2022-24777 – grpc-swift denial of service : The issue affects grpc-swift servers before version 1.7.2. It results from incorrect logic when handling GOAWAY frames, allowing a low-effort attack that can crash the server and drop all in-flight connections and requests. The impact on availabilit...

CVE-2022-24777: Reachable Assertion

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

grpc-go:fuzz_helloclient: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6754505314664448 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloclient Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision...

com.github.j5ik2o:grpc-gateway-runtime_2.12 (>=1.0.0, <=1.0.3), com.github.j5ik2o:grpc-gateway-runtime_2.13 (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.19.4)

org.webjars:swagger-ui MAVEN version 3.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.github.j5ik2o:grpc-gateway-runtime2.12 =1.0.0, =1.0.0, =2.0.11, =2.1.2 Source cves: CVE-2018-25031 Source...

Improper Authentication

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remote...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-23583 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-23583 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-23579 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-23579 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-23575 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-23575 Source...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2022-23577 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2022-23577 Source...