Denial Of Service (DoS) Via Ping Floods

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of pings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=5765765789122560 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...

grpc:client_fuzzer: Index-out-of-bounds in grpc_static_mdelem_for_static_strings

Project: https://github.com/grpc/grpc.git Detailed Report: https://oss-fuzz.com/testcase?key=5665813578645504 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

Coda: Use Github pack with Coda employee github account (search code of Coda's private repositories)

Summary: When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula Github..CodeSearch, the version of the Github...

Denial Of Service (DoS)

grpc-ts-health-check is vulnerable to denial of service DoS. The attack is possible as it does not protect its API endpoints, causing failure of service's health and thereby allowing Kubernetes to block traffic to services with a failing status...

Denial of Service

Overview Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing...

OPENSUSE-SU-2019:1703-1 Security update for helm

This update for helm to version 2.13.1 fixes the following issues: - set correct gitcommit value so that 'helm version' reports correctly - added service file for helm-serve - Require golang 1.10.6 or newer - Tiller should only enforce what we expect from Helm - Keepalive config should be...

Security update for helm (moderate)

openSUSE Security Update: Security update for helm Announcement ID: openSUSE-SU-2019:1703-1 Rating: moderate References: 1118897 1118898 1118899 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 An update that fixes thr...

RHEL 7 : etcd (RHSA-2019:1352)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1352 advisory. The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream...

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name CN which matches a valid RBAC username, a...

Moderate: Red Hat Security Advisory: etcd security, bug fix, and enhancement update

An update for etcd is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XR Software is affected by following vulnerability : - A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711

Cisco IOS XR Software vulnerability CVE-2019-1711 affects the Event Management Service daemon (emsd). The issue arises from improper handling of gRPC requests, allowing an unauthenticated, remote attacker to repeatedly send gRPC requests and cause emsd to crash, resulting in a DoS. Exploitation i...

CVE-2019-1711 Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-0034

CVE-2019-0034 is rejected/not used; the entry was withdrawn and does not represent a vulnerability.

OPENSUSE-SU-2019:0195-1 Security update for nginx

This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request',...

openSUSE Security Update : nginx (openSUSE-2019-195)

This update for nginx fixes the following issues : nginx was updated to 1.14.2 : - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request...