CVE-2020-7768: Improperly Controlled Modification of Object Prototype Attributes

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

grpc-gateway:fuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5700081334091776 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000027f62e71 Crash State: NULL Sanitizer: address ASAN Recommended...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1439-2 Rating: moderate References: 1174041 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1439-1 Rating: moderate References: 1174041 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

GHSA-M86M-5M44-PC93 Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

PT-2020-21398

Name of the Vulnerable Software and Affected Versions grpc-ts-health-check versions prior to 2.0.0 Description The issue allows attackers to set the service's health status to failing through an exposed API endpoint, leading to Denial of Service as Kubernetes blocks traffic to services with a...

@cowlick/analyzer (>=0.10.0, <=0.11.0), @cowlick/kag-compiler (>=0.10.0, <=0.11.0) +1 more potentially affected by CVE-2020-8244 via bl (3.0.0)

bl NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @cowlick/analyzer =0.10.0, =0.10.0, =1.0.0, =1.0.3 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...

3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)

grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: SNYK:JS-GRPC-598671...

@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)

@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...

Prototype Pollution

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview grpc is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

openSUSE Security Update : mumble (openSUSE-2020-1016)

This update for mumble fixes the following issues : mumble was updated 1.3.2 : - client: Fixed overlay not starting Update to upstream version 1.3.1 - Security - Fixed: Potential exploit in the OCB2 encryption 4227 boo1174041 - ICE - Fixed: Added missing UserKDFIterations field to UserInfo =...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1016-1 Rating: moderate References: 1174041 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for mumble fixes the...

Saferwall - A Hackable Malware Sandbox For The 21St Century

Saferwall is an open source malware analysis platform. It aims for the following goals: Provide a collaborative platform to share samples among malware researchers. Acts as a system expert, to help researchers generates an automated malware analysis report. Hunting platform to find new malwares...

Important Photon OS Security Update - PHSA-2020-0305

Updates of 'pcre', 'linux', 'linux-esx' packages of Photon OS have been released...

grpc:client_fuzzer: Heap-use-after-free in gpr_unref

Detailed Report: https://oss-fuzz.com/testcase?key=5680426091020288 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x610000000040 Crash State: gprunref grpcerrordounref...

Protecting gRPC applications and APIs

Wallarm has always stood out from its competitors when it comes to supporting modern stacks. For a long time Wallarm has been the only product to provide comprehensive protection for WebSockets-based web applications. Once again, Wallarm is glad to be the pioneer and add support for the gRPC...

grpc:json_fuzzer: Heap-buffer-overflow in internal_add_error

Detailed Report: https://oss-fuzz.com/testcase?key=5702719740575744 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: jsonfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x60e000006e40 Crash State: internaladderror grpcerrorcreate...

grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=6217576676065280 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...