CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1428 – Denial-of-Service in gRPC
https://notcve.org/view.php?id=CVE-2023-1428
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above. • https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8 • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7768 – Prototype Pollution
https://notcve.org/view.php?id=CVE-2020-7768
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. El paquete grpc versiones anteriores a 1.24.4; el paquete @grpc/grpc-js versiones anteriores a 1.1.8, son vulnerables a una contaminación de prototipo por medio de loadPackageDefinition • https://github.com/grpc/grpc-node/pull/1605 https://github.com/grpc/grpc-node/pull/1606 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819 https://snyk.io/vuln/SNYK-JS-GRPC-598671 https://snyk.io/vuln/SNYK-JS-GRPCGRPCJS-1038818 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9431
https://notcve.org/view.php?id=CVE-2017-9431
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. Google gRPC antes del 05-04-2017, presenta una escritura fuera de límites causada por un desbordamiento de búfer en la región heap de la memoria relacionado con el archivo core/lib/iomgr/error.c. • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1018 https://github.com/grpc/grpc/pull/10492 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-8359
https://notcve.org/view.php?id=CVE-2017-8359
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c. Google gRPC anterior a 2017-03-29 tiene una escritura fuera de límites causada por un uso después de liberación en el heap y relacionado con la función grpc_call_destroy en core/lib/surface/call.c. • http://www.securityfocus.com/bid/98280 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=726 https://github.com/grpc/grpc/pull/10353 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7860
https://notcve.org/view.php?id=CVE-2017-7860
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c. Google gRPC en versiones anteriores a 22-02-2017 tiene una escritura fuera de límites provocado por un desbordamiento de búfer basado en memoria dinámica en relación con la función parse_unix function en core/ext/client_chennel/parse_address.c. • http://www.securityfocus.com/bid/97695 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=661 https://github.com/grpc/grpc/pull/9833 • CWE-787: Out-of-bounds Write •