The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade grpc-cpp-debuginfoUpgrade grpc-dataUpgrade grpc-cppUpgrade grpc-plugins-debuginfoUpgrade grpc-pluginsUpgrade grpcUpgrade grpc-debugsourceUpgrade grpc-docUpgrade grpc-develUpgrade grpc-debuginfo | Feb 17, 2025 | Jun 9, 2023 |
| Redhat_linux | — | Upgrade rhc-worker-playbookUpgrade rhc-worker-playbook-debuginfo | Feb 10, 2025 | Jun 9, 2023 |
| Suse | — | Upgrade python311-abseilUpgrade libabsl2308_0_0-32bitUpgrade libprotobuf-lite25_1_0-32bitUpgrade libupb37Upgrade python311-protobufUpgrade re2-develUpgrade libprotobuf25_1_0Upgrade libgrpc++1_60Upgrade libprotobuf25_1_0-32bitUpgrade upb-develUpgrade libabsl2308_0_0Upgrade opencensus-proto-sourceUpgrade abseil-cpp-develUpgrade libre2-11Upgrade libgrpc37Upgrade libgrpc1_60Upgrade python311-grpcioUpgrade protobuf-javaUpgrade libprotoc25_1_0Upgrade grpc-develUpgrade grpc-sourceUpgrade libprotoc25_1_0-32bitUpgrade protobuf-develUpgrade libre2-11-32bitUpgrade libprotobuf-lite25_1_0 | Feb 22, 2024 | Jun 9, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub