Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and...

Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.17 and earlier

Summary This fix upgrades to Websphere Liberty 24.0.0.6, socket.io 3.0.2, and grpc-js 1.8.22. Websphere Liberty is used by the IBM Answer Retrieval for Watson Discovery swagger microservice. Socket.io and grpc-js are used by the IBM Answer Retrieval for Watson Discovery user interfaces for...

CBL Mariner 2.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-32067)

The version of c-ares / fluent-bit / grpc / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-32067 advisory. - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of...

CBL Mariner 2.0 Security Update: c-ares / nodejs / python-gevent / grpc (CVE-2022-4904)

The version of c-ares / nodejs / python-gevent / grpc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-4904 advisory. - A flaw was found in the c-ares package. The aressetsortlist is missing checks...

CBL Mariner 2.0 Security Update: boost / cloud-hypervisor-cvm / cmake / erlang / grpc / mariadb / nmap / qt5-qtbase / teckit (CVE-2018-25032)

The version of boost / cloud-hypervisor-cvm / cmake / erlang / grpc / mariadb / nmap / qt5-qtbase / teckit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2018-25032 advisory. - zlib before 1.2.12 allo...

CBL Mariner 2.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-31147)

The version of c-ares / fluent-bit / grpc / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-31147 advisory. - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom a...

CBL Mariner 2.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-31130)

The version of c-ares / fluent-bit / grpc / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-31130 advisory. - c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a...

CBL Mariner 2.0 Security Update: containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc (CVE-2023-47108)

The version of containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47108 advisory. - OpenTelemetry-Go Contrib is a collecti...

CBL Mariner 2.0 Security Update: grpc / python-gevent (CVE-2020-22217)

The version of grpc / python-gevent installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-22217 advisory. - Buffer overflow vulnerability in c-ares before 1161 thru 1170 via function aresparsesoareply i...

Denial-of-Service in gRPC

...

GO-2023-2331 Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service...

MAL-2024-2439 Malicious code in grpc-web-devtoolssss (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in grpc-web-devtoolssss (npm)

--- -= Per source details. Do not edit below this line.=-...

BIT-GITLAB-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

OPENSUSE-SU-2024:13621-1 grpc-devel-1.60.0-3.1 on GA media

These are all security issues fixed in the grpc-devel-1.60.0-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13391-1 grpc-devel-1.59.2-1.1 on GA media

These are all security issues fixed in the grpc-devel-1.59.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13956-1 ruby3.3-rubygem-grpc-1.63.0-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-grpc-1.63.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12794-1 ruby3.1-rubygem-grpc-1.52.0-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-grpc-1.52.0-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression

go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...