2333 matches found
PT-2021-21142 Ā· Unknown Ā· Grpc Swift
Name of the Vulnerable Software and Affected Versions: gRPC Swift versions 1.1.1 and earlier Description: The issue allows remote attackers to cause a denial of service via the delivery of many small messages within a single HTTP/2 frame, leading to uncontrolled recursion and stack consumption...
PT-2021-21141 Ā· Unknown Ā· Grpc Swift
Name of the Vulnerable Software and Affected Versions: gRPC Swift versions 1.1.0 through 1.1.1 Description: The issue is related to mismanaged state in the GRPCWebToHTTP2ServerCodec.swift file, allowing remote attackers to cause a denial of service by sending malformed requests. Affected gRPC Swi...
CVE-2021-36153: Undefined Security Weakness
Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests...
grpc-gateway:fuzz: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5761259185242112 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...
SUSE: Security Advisory (SUSE-SU-2019:0334-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Envoy integer overflow vulnerability
Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
CVE-2021-28682
CVE-2021-28682 affects Envoy (through 1.71.1) with a remotely exploitable integer overflow triggered by an extremely large grpc-timeout value that leads to incorrect timeout calculations. The vulnerability details are corroborated across connected sources (BIT-ENVOY-2021-28682, OSV entries) and s...
CVE-2021-28682: Integer Overflow or Wraparound
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
grpc-swift:grpc-swift-fuzz-debug: Invalid-free in GRPC.GRPCWebToHTTP2ServerCodec.StateMachine.
Project: https://github.com/grpc/grpc-swift.git Detailed Report: https://oss-fuzz.com/testcase?key=4645975625957376 Project: grpc-swift Fuzzing Engine: libFuzzer Fuzz Target: grpc-swift-fuzz-debug Job Type: libfuzzerasangrpc-swift Platform Id: linux Crash Type: Invalid-free Crash Address:...
Prototype Pollution
Overview "The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition." Recommendation Upgrade to version 1.1.8 or later References - CVE - GitHub Advisory...
GHSA-PP75-XFPW-37G9 Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)
grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: OSV:GHSA-PP75-XFPW-37G9...
@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)
@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...
envoyproxy/envoy: integer overflow handling large grpc-timeouts
A flaw was found in envoyproxy/envoy. An attacker, able to craft a packet which specifies a large grpc-timeout, can potentially cause envoy to incorrectly calculate the timeouts resulting in a denial of service. The highest threat from this vulnerability is to system availability...
grpc-gateway:fuzz: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5840342097199104 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...
grpc-gateway:fuzz: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=6396072475885568 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcrea...