[SECURITY] Fedora 36 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-3.fc36

GRPC to JSON proxy generator following the gRPC HTTP spec...

Fedora: Security Advisory for golang-github-grpc-ecosystem-gateway-2 (FEDORA-2022-3a63897745)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: grpcurl-1.8.6-2.fc34

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers...

[SECURITY] Fedora 35 Update: grpcurl-1.8.6-2.fc35

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers...

[SECURITY] Fedora 35 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-3.fc35

GRPC to JSON proxy generator following the gRPC HTTP spec...

go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

GHSA-H6XX-PMXH-3WGP go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

grpc-go:fuzz_helloclient: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4632082384551936 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloclient Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN...

Denial of Service (DoS)

Overview grpc/grpc-swift is a Swift language implementation of gRPC. Affected versions of this package are vulnerable to Denial of Service DoS via reachable assertion, due to an incorrect logic when handling GOAWAY frames. Details Denial of Service DoS describes a family of attacks, all aimed at...

CVE-2022-24777

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

Code injection

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777

CVE-2022-24777 – grpc-swift denial of service : The issue affects grpc-swift servers before version 1.7.2. It results from incorrect logic when handling GOAWAY frames, allowing a low-effort attack that can crash the server and drop all in-flight connections and requests. The impact on availabilit...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777: Reachable Assertion

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

grpc-go:fuzz_helloclient: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6754505314664448 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloclient Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision...

Improper Authentication

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remote...

grpc-swift:ServerFuzzer-release: Invalid-free in NIOHTTP2.NIOHTTP2Handler.

Project: https://github.com/grpc/grpc-swift.git Detailed Report: https://oss-fuzz.com/testcase?key=6318975863095296 Project: grpc-swift Fuzzing Engine: libFuzzer Fuzz Target: ServerFuzzer-release Job Type: libfuzzerasangrpc-swift Platform Id: linux Crash Type: Invalid-free Crash Address:...