It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-282 advisory.

  - When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame.
    This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables     between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests     from the proxy being interpreted as containing headers from different proxy clients - leading to an     information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading     beyond the commit contained in https://github.com/grpc/grpc/pull/33005     https://github.com/grpc/grpc/pull/33005 (CVE-2023-32731)

  - gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy     and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by     the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in     https://github.com/grpc/grpc/pull/32309 https://www.google.com/url (CVE-2023-32732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2023-282)

high Nessus Plugin ID 179767

Version 1.1

Version 1.0

Version 1.1 Oct 17, 2023, 6:13 AM CVE (set "CVE" coverage to "CVE-2023-32731,CVE-2023-32732,CVE-2023-4785") Plugin metadata Plugin Feed: 202310170613
Version 1.0 Aug 15, 2023, 12:07 AM New Plugin Feed: 202308150007