2930 matches found
Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)
@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...
GHSA-PP75-XFPW-37G9 Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)
grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: OSV:GHSA-PP75-XFPW-37G9...
@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)
@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...
3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)
grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: GHSA-PP75-XFPW-37G9...
envoyproxy/envoy: integer overflow handling large grpc-timeouts
A flaw was found in envoyproxy/envoy. An attacker, able to craft a packet which specifies a large grpc-timeout, can potentially cause envoy to incorrectly calculate the timeouts resulting in a denial of service. The highest threat from this vulnerability is to system availability...
grpc-gateway:fuzz: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5840342097199104 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...
grpc-gateway:fuzz: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=6396072475885568 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcrea...
grpc-gateway:fuzz: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6241805840547840 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000304190b9 Crash State: NULL Sanitizer: address ASAN Recommended...
cn.xphsc.boot:kubernetes-spring-boot-starer (1.0.0-rc), com.bybutter.sisyphus.middleware:sisyphus-grpc-client-kubernetes (>=0.0.6-m0, <=0.0.6-m3) +11 more potentially affected by CVE-2020-8570 via io.kubernetes:client-java (>=9.0.0, <=9.0.1)
io.kubernetes:client-java MAVEN version =9.0.0, =0.0.6-m0, =0.9.8.3, =0.9.8.3, =0.9.8.3, =9.0.0, =9.0.0, =9.0.0, =3.6.17, =5.0.0 Source cves: CVE-2020-8570 Source advisory: GHSA-CGHX-9GCR-R42X...
Prototype Pollution in grpc/grpc-node
Description grpc native core package is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following PoC file: js // poc.js var grpc =require'grpc'...
grpc-go:fuzz_helloserver: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5930640874799104 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloserver Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000034150897 Crash State: NULL Sanitizer: address ASAN Recommende...
grpc-go:fuzz_helloserver: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5203482091061248 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloserver Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...
ASB-A-170407229
In dispatchGraphTerminationMessage of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...
Photon OS 2.0: Grpc PHSA-2020-2.0-0305
An update of the grpc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0305. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144217;...
Photon OS 3.0: Grpc PHSA-2020-3.0-0176
An update of the grpc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0176. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144218;...
Critical Photon OS Security Update - PHSA-2020-3.0-0176
Updates of 'grpc' packages of Photon OS have been released...