Connection Confusion

🗓️ 07 Jul 2023 03:56:21Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 23 Views

Connection Confusion vulnerability in grpc HTTP2 stac

Reporter	Title	Published	Views	Family All 60
IBM Security Bulletins	Security Bulletin: Vulnerabilities in gRPC affect watsonx.data	25 Sep 202419:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator	28 Aug 202308:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server	14 Dec 202321:06	–	ibm
IBM Security Bulletins	Security Bulletin: gRPC HTTP/2 HPACK Desynchronization Vulnerability Allowing Header Leakage and Privilege Escalation, affects watsonx.data	4 Dec 202508:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436	21 Oct 202414:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2023-32731 CVE-2023-32732)	21 Nov 202512:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in gRPC	27 Jul 202322:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 which is shipped with IBM Intelligent Operations Center.	18 Dec 202308:12	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in gRPC may affect IBM Robotic Process Automation and result in an attacker obtaining sensitive information. (CVE-2023-32731)	20 Sep 202314:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Db2 affect Cloud Pak System	28 Oct 202416:03	–	ibm

Vulners

Node

grpcio grpcioRange0.9.0a1–1.52.0cpp

grpc grpcRange0.9.4–1.52.2cpp

grpc.net.client grpc.net.clientRange0.1.21-pre1–2.51.0cpp

grpc-xds grpc-xdsRange1.33.1–1.52.1cpp

grpc grpcRange0.6.0–1.52.0cpp

libgrpc.so libgrpc.soRange0.11.0.0–30.0.0cpp

Source	Link
github	www.github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10
github	www.github.com/grpc/grpc/pull/32309
github	www.github.com/advisories/GHSA-cfgp-2977-2fmm
github	www.github.com/grpc/grpc-dotnet/commit/2cdbf1c3089458ca507fd1b23983698ad5fd8329
github	www.github.com/grpc/grpc-java/commit/501ca8f7b4f9c5288ca6deaa9191d1b2ee930cc8
github	www.github.com/grpc/grpc/pull/33005
github	www.github.com/grpc/grpc/pull/33005

07 Jul 2023 19:47Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.4 - 7.5

EPSS0.00502

SSVC