CVE-2023-1428: Denial-of-Service in gRPC
gRPC is vulnerable to a denial of service. By sending a specially crafted header, an attacker could exploit this vulnerability to cause a denial of service.
Other sources
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclbclientstats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grpc/grpcto a version that resolves this vulnerability.Fixed in 1.52.2 - Upgrade
Upgrade
grpc/grpcto a version that resolves this vulnerability.Fixed in 1.53.1 - Upgrade
Upgrade
grpc/grpcto a version that resolves this vulnerability.Fixed in 1.54.2 - Upgrade
Upgrade
grpc/grpcto a version that resolves this vulnerability.Fixed in 1.55.0
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-1428.
What is the severity of CVE-2023-1428?
The severity of CVE-2023-1428 is high with a CVSS score of 7.5.
Which software is affected by CVE-2023-1428?
Grpc versions between 1.51.0 and 1.53.0 are affected by CVE-2023-1428.
How does CVE-2023-1428 manifest?
CVE-2023-1428 manifests as an abort() being called in gRPC's C++ implementation when certain headers are sent.
Is there a fix available for CVE-2023-1428?
Yes, the fix for CVE-2023-1428 can be found in the following commit: https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8