~ / search / GHSA-p25m-jpj4-qcrr

GHSA-p25m-jpj4-qcrr

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Source: GitHub Advisory Database (reviewed) High CVE-2023-4785

Packages

EcosystemPackageAffectedFixed in
RubyGems grpc >= 1.56.0, < 1.56.2 1.56.2
RubyGems grpc >= 1.55.0, < 1.55.3 1.55.3
RubyGems grpc >= 1.54.0, < 1.54.3 1.54.3
RubyGems grpc >= 1.53.0, < 1.53.2 1.53.2
PyPI grpcio >= 1.55.0, < 1.55.3 1.55.3
PyPI grpcio >= 1.54.0, < 1.54.3 1.54.3
PyPI grpcio >= 1.53.0, < 1.53.2 1.53.2

Details

As written in the advisory (Markdown source, shown as plain text).

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

References

External links from the advisory. They lead to third-party sites.