PT-2024-16964 · Google +2 · Grpc-C++ +2

Name of the Vulnerable Software and Affected Versions: gRPC-C++ versions up to 1.66.1 Description: gRPC-C++ servers with transmit zero copy enabled through the channel argument GRPC ARG TCP TX ZEROCOPY ENABLED can experience data corruption issues. The data sent by the application may be corrupte...

This Week in Spring - November 5th, 2024

This Week in Spring - November 5th, 2024 Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 5th of November, 2024, and, um, I - an American - am desperately trying to keep calm and carry on. I did everything I can do VOTE!, and so it's with considerable enthusiasm th...

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining...

Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

In this blog entry, we discuss how malicious actors are exploiting Docker remote API servers via gRPC/h2c to deploy the cryptominer SRBMiner to facilitate their mining of XRP on Docker hosts...

Security Bulletin: IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436

Summary IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-32731 DESCRIPTION: gRPC...

[SECURITY] Fedora 40 Update: rust-tonic-0.12.3-1.fc40

A gRPC over HTTP/2 implementation focused on high performance, interoperability, and flexibility...

[SECURITY] Fedora 40 Update: rust-tonic-build-0.12.3-1.fc40

Codegen module of tonic gRPC implementation...

[SECURITY] Fedora 39 Update: rust-tonic-build-0.12.3-1.fc39

Codegen module of tonic gRPC implementation...

[SECURITY] Fedora 39 Update: rust-tonic-0.12.3-1.fc39

A gRPC over HTTP/2 implementation focused on high performance, interoperability, and flexibility...

MAL-2024-9748 Malicious code in otlp-grpc-exporter-base (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in otlp-grpc-exporter-base (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9676 Malicious code in js-rust-grpc-quotes (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9668 Malicious code in instrumentation-grpc (npm)

--- -= Per source details. Do not edit below this line.=-...

[SECURITY] Fedora 41 Update: rust-tonic-build-0.12.3-1.fc41

Codegen module of tonic gRPC implementation...

[SECURITY] Fedora 41 Update: rust-tonic-0.12.3-1.fc41

A gRPC over HTTP/2 implementation focused on high performance, interoperability, and flexibility...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.34.0 security update & enhancements

Release of OpenShift Serverless Logic 1.34.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

K000141352: Multiple gRPC vulnerabilities

Security Advisory Description CVE-2020-7768 The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. CVE-2017-9431 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related...

Pomerium service account access token may grant unintended access to databroker API

Impact We've identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments. Who is affected? A Pomerium deployment is susceptible to this issue if all of the...

GHSA-R7RH-JWW5-5FJR Pomerium service account access token may grant unintended access to databroker API

Impact We've identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments. Who is affected? A Pomerium deployment is susceptible to this issue if all of the...

CVE-2024-47609

Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that...