grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=6217576676065280 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...

CVE-2018-16886

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name CN which matches a valid RBAC username, a...

Haaukins - A Highly Accessible And Automated Virtualization Platform For Security Education

Haaukins is a highly accessible and automated virtualization platform for security education, it has three main components Docker, Virtualbox and Golang, the communication and orchestration between the components managed using Go programming language. The main reason of having Go environment to...

openSUSE: Security Advisory for haproxy (openSUSE-SU-2019:2555-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Advisory 0043

Security Advisory 0043 PDF Date: November 6th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | November 6th, 2019 | Initial Release The CVE-IDs tracking this issue: CVE-2019-9512, CVE-2019-9514, and CVE-2019-9515 CVSSv3 Base Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description...

grpc:api_fuzzer: Heap-use-after-free in gpr_unref

Project: https://github.com/grpc/grpc.git Detailed Report: https://oss-fuzz.com/testcase?key=5651679584452608 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x610000000240 Crash...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability exists in Ident protocol handler of Cisco IOS and IOS XE Software due to incorrectly handling memory structures, leading to a NULL pointer dereference. An unauthenticated, remote...

Information Disclosure

github.com/grpc/grpc-go is vulnerable to information disclosure. A context leak occurs when a stream is not successfully created, potentially disclosing confidential information contained within a context...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.1.18 gRPC security update

An update for gRPC, included in sriov-network-device-plugin-container, is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 4.1.15 gRPC security update

An update for gRPC, included in multus-cni-container, operator-lifecycle-manager-container, and operator-registry-container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Denial Of Service (DoS) Via Settings Flood

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of settings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

Denial Of Service (DoS) Via Ping Floods

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of pings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=5765765789122560 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...

grpc:client_fuzzer: Index-out-of-bounds in grpc_static_mdelem_for_static_strings

Project: https://github.com/grpc/grpc.git Detailed Report: https://oss-fuzz.com/testcase?key=5665813578645504 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

Coda: Use Github pack with Coda employee github account (search code of Coda's private repositories)

Summary: When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula Github..CodeSearch, the version of the Github...

Denial Of Service (DoS)

grpc-ts-health-check is vulnerable to denial of service DoS. The attack is possible as it does not protect its API endpoints, causing failure of service's health and thereby allowing Kubernetes to block traffic to services with a failing status...

Denial of Service

Overview Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing...

OPENSUSE-SU-2019:1703-1 Security update for helm

This update for helm to version 2.13.1 fixes the following issues: - set correct gitcommit value so that 'helm version' reports correctly - added service file for helm-serve - Require golang 1.10.6 or newer - Tiller should only enforce what we expect from Helm - Keepalive config should be...

Security update for helm (moderate)

openSUSE Security Update: Security update for helm Announcement ID: openSUSE-SU-2019:1703-1 Rating: moderate References: 1118897 1118898 1118899 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 An update that fixes thr...

RHEL 7 : etcd (RHSA-2019:1352)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1352 advisory. The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream...