CBL Mariner 2.0 Security Update: c-ares / nodejs / python-gevent / grpc (CVE-2022-4904)

The version of c-ares / nodejs / python-gevent / grpc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-4904 advisory. - A flaw was found in the c-ares package. The aressetsortlist is missing checks...

Denial-of-Service in gRPC

...

GO-2023-2331 Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service...

Malicious code in grpc-web-devtoolssss (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2439 Malicious code in grpc-web-devtoolssss (npm)

--- -= Per source details. Do not edit below this line.=-...

BIT-GITLAB-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

OPENSUSE-SU-2024:13391-1 grpc-devel-1.59.2-1.1 on GA media

These are all security issues fixed in the grpc-devel-1.59.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12794-1 ruby3.1-rubygem-grpc-1.52.0-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-grpc-1.52.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13956-1 ruby3.3-rubygem-grpc-1.63.0-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-grpc-1.63.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13621-1 grpc-devel-1.60.0-3.1 on GA media

These are all security issues fixed in the grpc-devel-1.60.0-3.1 package on the GA media of openSUSE Tumbleweed...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...

GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression

go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...

Denial Of Service (DoS)

github.com/klauspost/compress/zstd is vulnerable to a Denial of service DoS. The vulnerability is due to its zstd decompression implementation not respecting the limits imposed by gRPC, which allows attacker to trigger rapid and uncontrolled increases in memory usage on the server or client...

CVE-2024-5469

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469 Uncontrolled Resource Consumption in GitLab

DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests...

CVE-2024-5469

CVE-2024-5469 affects GitLab CE/EE KAS. A DoS via crafted gRPC requests crashes KAS, impacting all versions 16.10.0–16.10.5 and 16.11.0–16.11.2 (pre-16.10.6 and pre-16.11.3). Exploit details are not provided in the documents; no active exploit specifics are given here. Connected notes indicate Gi...

CVE-2024-5469

Removed by vendor...

CVE-2024-37168

A flaw was found in grps-js, which implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channe...