CVE-2024-35223

CVE-2024-35223 affects Dapr where, when acting as a gRPC proxy for remote service invocation, the proxy may leak the invoker app’s token to the invoked app due to incorrect token handling. The root cause is that the proxy forwards the invoker’s app token (APP_API_TOKEN) instead of the invoked app...

GHSA-284C-X8M7-9W5H Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

RHEL 8 : Satellite 6.14.2 Async Security Update (Important) (RHSA-2024:0797)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0797 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in Google gRPC [CVE-2023-4785]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in Google gRPC, caused by a lack of error handling in the TCP server on posix-compatible platforms CVE-2023-4785. Google gRPC is used in our Speech Services runtimes. This vulnerabilitiy has...

CVE-2023-31147 affecting package grpc for versions less than 1.62.0-2

CVE-2023-31147 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-31130 affecting package grpc for versions less than 1.62.0-2

CVE-2023-31130 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-32067 affecting package grpc for versions less than 1.62.0-2

CVE-2023-32067 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-4904 affecting package grpc for versions less than 1.62.0-2

CVE-2022-4904 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-4785 affecting package grpc for versions less than 1.62.0-2

CVE-2023-4785 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-33953 affecting package grpc for versions less than 1.62.0-2

CVE-2023-33953 affecting package grpc for versions less than 1.62.0-2. An upgraded version of the package is available that resolves this issue...

Spring Tips: GRPC

Hi, Spring fans! In this installment, we look at how to create GRPC-based services with Spring Boot...

Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to installation denial of service due to grpc ( CVE-2023-44487 )

Summary Grpc is used by IBM Cloud Pak for Data Scheduling as part of the image catalog used for installation. CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the...

Security Bulletin: Due to the use of OpenTelemetry gRPC, IBM CICS TX Standard is vulnerable to an Denial of Service vulnerability (CVE-2023-47108).

Summary There is a vulnerability in OpenTelemetry gRPC package which is shipped as part of IBM CICS TX Standard. An update to IBM CICS TX Standard has been released to address the vulnerability. Vulnerability Details CVEID:CVE-2023-47108 DESCRIPTION: OpenTelemetry OpenTelemetry-Go Contrib is...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: cosign, nerdctl, dgraph, rekor, aactl, fulcio, grpc-health-probe, kubescape, skopeo, weaviate, k3s, gomplate, bank-vaults, caddy, frp, temporal-ui-server, cloudflared, vexctl, guac, tkn, falcoctl, oauth2-proxy, step-ca, zot, apko, flux-source-controller, skaffold,...

BIT-ENVOY-2022-29224 Segmentation fault leading to crash in Envoy

Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” prevent removal upstrea...

BIT-ENVOY-2023-27487 Envoy client may fake the header `x-envoy-original-path`

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an internal header, but...

BIT-ENVOY-2023-27488 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when failuremodeallow: true is configured for extauthz filter. For affected components that are used for loggin...

BIT-ENVOY-2023-35942 Envoy's gRPC access log crash caused by the listener draining

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a use-after-free crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9,...

BIT-ENVOY-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to extauthz, circumventing extauthz checks when failuremodeallow is set to true. This issue has been addressed in...