AZL-34772
Dashboard / Vulnerabilities / AZL-34772
Summary: CVE-2023-4785 affecting package grpc for versions less than 1.62.0-2
Details: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
References: https://nvd.nist.gov/vuln/detail/CVE-2023-4785
Affected packages
Package
Name: grpc
Purl: pkg:rpm/azure-linux/grpc
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -1.62.0-2
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
