When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade grpc-develUpgrade grpc-debuginfoUpgrade grpc-plugins-debuginfoUpgrade grpc-dataUpgrade grpc-pluginsUpgrade grpc-docUpgrade grpc-debugsourceUpgrade grpcUpgrade grpc-cpp-debuginfoUpgrade grpc-cpp | Feb 17, 2025 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade rhc-worker-playbook-debuginfoUpgrade rhc-worker-playbook | Feb 10, 2025 | Jun 9, 2023 |
| Suse | — | Upgrade libupb37Upgrade libabsl2308_0_0-32bitUpgrade python311-protobufUpgrade libprotobuf25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade libprotobuf-lite25_1_0-32bitUpgrade libgrpc++1_60Upgrade python311-abseilUpgrade re2-develUpgrade upb-develUpgrade opencensus-proto-sourceUpgrade libabsl2308_0_0Upgrade libre2-11-32bitUpgrade libprotoc25_1_0-32bitUpgrade libgrpc1_60Upgrade abseil-cpp-develUpgrade libre2-11Upgrade libgrpc37Upgrade grpc-develUpgrade libprotobuf-lite25_1_0Upgrade protobuf-javaUpgrade libprotoc25_1_0Upgrade python311-grpcioUpgrade protobuf-develUpgrade grpc-source | Feb 22, 2024 | Jun 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub