Denial Of Service (DoS)

🗓️ 12 Jun 2024 07:45:06Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

vulnerability in @grpc/grpc-js due to improper message size checks

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js and packages affect IBM Voice Gateway	17 Sep 202421:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses grpc-js-1.8.21.tgz which is vulnerable to CVE-2024-37168	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.17 and earlier	4 Jul 202415:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	6 Jan 202605:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js (CVE-2024-35255, CVE-2024-37168)	22 Jul 202415:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2024-37168] [CVE-2024-34890]	23 Aug 202410:03	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	14 Aug 202409:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to denial of service vulnerability in gRPC on Node.js [CVE-2024-37168]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in grpc-js-1.7.3.tgz	22 Oct 202511:23	–	ibm

Vulners

Node

grpc-js @grpc/grpc-jsRange1.10.0–1.10.8js

grpc-js @grpc/grpc-jsRange1.9.0–1.9.14js

grpc-js @grpc/grpc-jsRange0.2.0–1.8.21js

Source	Link
github	www.github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
github	www.github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
github	www.github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
github	www.github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3

12 Jun 2024 21:57Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3

EPSS0.00283

SSVC