CVE-2023-1428: Denial-of-Service in gRPC
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclbclientstats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grpcto a version that resolves this vulnerability.Fixed in 1.52.2 - Upgrade
Upgrade
grpcto a version that resolves this vulnerability.Fixed in 1.53.1 - Upgrade
Upgrade
grpcto a version that resolves this vulnerability.Fixed in 1.54.2 - Upgrade
Upgrade
grpcto a version that resolves this vulnerability.Fixed in 1.55.0
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-1428.
What is the severity of CVE-2023-1428?
The severity of CVE-2023-1428 is high with a CVSS score of 7.5.
Which software is affected by CVE-2023-1428?
Grpc versions between 1.51.0 and 1.53.0 are affected by CVE-2023-1428.
How does CVE-2023-1428 manifest?
CVE-2023-1428 manifests as an abort() being called in gRPC's C++ implementation when certain headers are sent.
Is there a fix available for CVE-2023-1428?
Yes, the fix for CVE-2023-1428 can be found in the following commit: https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8