CVE-2023-4785
High
Description
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGrpc
PublishedSep 13, 2023
First seenSep 13, 2023
Weakness typeCWE-248CWE-248
How to fix
Update
- grpc grpc1.53.2, 1.54.3, 1.55.3 or later
- grpc1.56.2, 1.55.3, 1.54.3, 1.53.2 or later
- grpcio1.55.3, 1.54.3, 1.53.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grpc grpc | 1.23.0 ≤ v < 1.53.2, 1.54.0 ≤ v < 1.54.3, 1.55.0 ≤ v < 1.55.3, 1.56.0 | 1.53.2, 1.54.3, 1.55.3 |
| grpcRubyGems | 1.56.0 ≤ v < 1.56.2, 1.55.0 ≤ v < 1.55.3, 1.54.0 ≤ v < 1.54.3, 1.53.0 ≤ v < 1.53.2 | 1.56.2, 1.55.3, 1.54.3, 1.53.2 |
| grpcioPyPI | 1.55.0 ≤ v < 1.55.3, 1.54.0 ≤ v < 1.54.3, 1.53.0 ≤ v < 1.53.2 | 1.55.3, 1.54.3, 1.53.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.