Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability exists in Ident protocol handler of Cisco IOS and IOS XE Software due to incorrectly handling memory structures, leading to a NULL pointer dereference. An unauthenticated, remote...

Information Disclosure

github.com/grpc/grpc-go is vulnerable to information disclosure. A context leak occurs when a stream is not successfully created, potentially disclosing confidential information contained within a context...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.1.18 gRPC security update

An update for gRPC, included in sriov-network-device-plugin-container, is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 4.1.15 gRPC security update

An update for gRPC, included in multus-cni-container, operator-lifecycle-manager-container, and operator-registry-container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Denial Of Service (DoS) Via Settings Flood

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of settings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

Denial Of Service (DoS) Via Ping Floods

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of pings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=5765765789122560 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...

grpc:client_fuzzer: Index-out-of-bounds in grpc_static_mdelem_for_static_strings

Detailed Report: https://oss-fuzz.com/testcase?key=5665813578645504 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: grpcstaticmdelemforstaticstrings grpcmdelem...

Coda: Use Github pack with Coda employee github account (search code of Coda's private repositories)

Summary: When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula Github..CodeSearch, the version of the Github...

Denial Of Service (DoS)

grpc-ts-health-check is vulnerable to denial of service DoS. The attack is possible as it does not protect its API endpoints, causing failure of service's health and thereby allowing Kubernetes to block traffic to services with a failing status...

Denial of Service

Overview Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing...

OPENSUSE-SU-2019:1703-1 Security update for helm

This update for helm to version 2.13.1 fixes the following issues: - set correct gitcommit value so that 'helm version' reports correctly - added service file for helm-serve - Require golang 1.10.6 or newer - Tiller should only enforce what we expect from Helm - Keepalive config should be...

Security update for helm (moderate)

openSUSE Security Update: Security update for helm Announcement ID: openSUSE-SU-2019:1703-1 Rating: moderate References: 1118897 1118898 1118899 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 An update that fixes thr...

RHEL 7 : etcd (RHSA-2019:1352)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1352 advisory. The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream...

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name CN which matches a valid RBAC username, a...

Moderate: Red Hat Security Advisory: etcd security, bug fix, and enhancement update

An update for etcd is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XR Software is affected by following vulnerability : - A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711 Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...