PT-2023-4885 · Grpc+1 · Grpc+1
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
gRPC versions prior to v1.53
Description
The issue is related to the gRPC C++ implementation, where certain headers can cause an abort() to be called when sent via http2. The affected headers include
te: x (where x is not trailers), :scheme: x (where x is not http or https), and grpclb client stats: x (where x can be any value). To trigger the issue, a later header must be sent that increases the total header size past 8KB.Recommendations
To resolve the issue, upgrade to gRPC version v1.53 or later. As a temporary workaround, consider restricting the use of the vulnerable headers (
te, :scheme, and grpclb client stats) in the affected API endpoints until a patch is available. Avoid using these headers in combinations that could exceed the 8KB header size limit.Exploit
Fix
Assertion Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Grpc