PT-2021-21143 · Unknown · Grpc Swift

Glbrntt · Published 2021-07-09 · Updated 2023-06-09 · CVE-2021-36155

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: gRPC Swift versions 1.1.0 and earlier

Description: The issue allows remote attackers to cause uncontrolled resource consumption and deny service due to the allocation of buffers of arbitrary length when parsing messages. This can lead to excessive memory allocation, resulting in a denial of service.

Recommendations: For gRPC Swift versions 1.1.0 and earlier, upgrade to version 1.2.0 to resolve the issue.

Fix

Buffer Overflow

Allocation of Resources Without Limits

Weakness Enumeration

CWE-120

CWE-770

Related Identifiers

CVE-2021-36155

GHSA-RXMJ-HG9V-VP3P

Affected Products

Grpc Swift

References · 8

• https://osv.dev/vulnerability/GHSA-rxmj-hg9v-vp3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36155 · Security Note
• https://github.com/grpc/grpc-swift/security/advisories/GHSA-rxmj-hg9v-vp3p · Note
• https://github.com/grpc/grpc-swift/releases · Note
• https://github.com/grpc/grpc-swift/releases/tag/1.2.0 · Note
• https://github.com/grpc/grpc-swift · Note
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35303 · Note