CVE-2023-32732
Medium
Description
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
SeverityMedium
CVSS5.3
Exploit probability—
Product
Grpc
PublishedJun 9, 2023
First seenJun 9, 2023
Weakness typeCWE-440CWE-440
How to fix
Update
- grpc grpc1.53.0 or later
- io.grpc:grpc-protobuf1.53.1, 1.54.2 or later
- grpcio1.53.1, 1.54.2 or later
- grpc1.53.1, 1.54.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grpc grpc | v < 1.53.0 | 1.53.0 |
| fedoraproject fedora | 37, 38 | — |
| io.grpc:grpc-protobufMaven | 1.53.0 ≤ v < 1.53.1, 1.54.0 ≤ v < 1.54.2 | 1.53.1, 1.54.2 |
| grpcioPyPI | 1.53.0 ≤ v < 1.53.1, 1.54.0 ≤ v < 1.54.2 | 1.53.1, 1.54.2 |
| grpcRubyGems | 1.53.0 ≤ v < 1.53.1, 1.54.0 ≤ v < 1.54.2 | 1.53.1, 1.54.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.