GHSA-6628-q6j9-w8vg
gRPC Reachable Assertion issue
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-1428
- Alias
- PYSEC-2026-1425
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · io.grpc:grpc-protobuf | introduced 1.51.0, fixed 1.53.0 |
| PyPI · grpcio | introduced 1.51.0, fixed 1.53.0 |
| RubyGems · grpc | introduced 1.51.0, fixed 1.53.0 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-1428 ADVISORY
- https://github.com/grpc/grpc/issues/33463 WEB
- https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8 WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |