CVE-2023-32732: Denial-of-Service in gRPC
First published: Fri Jun 09 2023(Updated: )
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
Credit: cve-coordination@google.com cve-coordination@google.com cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grpc Grpc | <1.53.0 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 | |
| rubygems/grpc | <1.53.0 | 1.53.0 |
| pip/grpcio | <1.53.0 | 1.53.0 |
| maven/io.grpc:grpc-protobuf | <1.53.0 | 1.53.0 |
| IBM Cloud Pak for Business Automation | <=V23.0.1 - V23.0.1-IF001 | |
| IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF023 | |
| IBM Cloud Pak for Business Automation | <=V22.0.2 - V22.0.2-IF006 and later fixes V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixes V21.0.1 - V21.0.1-IF007 and later fixes V20.0.1 - V20.0.3 and later fixes V19.0.1 - V19.0.3 and later fixes V18.0.0 - V18.0.2 and later fixes |
Remedy
Fixes available in these releases: - 1.52.2: https://github.com/grpc/grpc/releases/tag/v1.52.2 https://github.com/grpc/grpc/releases/tag/v1.52.2 - 1.53.1: https://github.com/grpc/grpc/releases/tag/v1.53.1 https://github.com/grpc/grpc/releases/tag/v1.53.1 - 1.54.2: https://github.com/grpc/grpc/releases/tag/v1.54.2 https://github.com/grpc/grpc/releases/tag/v1.54.2 - 1.55.0: https://github.com/grpc/grpc/releases/tag/v1.55.0 https://github.com/grpc/grpc/releases/tag/v1.55.0
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/grpc/grpc/pull/32309
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL/
- https://nvd.nist.gov/vuln/detail/CVE-2023-32732
- https://github.com/grpc/grpc/releases/tag/v1.53.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32732.yml
- https://github.com/advisories/GHSA-9hxf-ppjv-w6rq (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/257693
- https://www.ibm.com/support/pages/node/7030357 (Advisory)
Frequently Asked Questions
What is CVE-2023-32732?
CVE-2023-32732 is a vulnerability in gRPC that allows a client to cause a termination of connection between a HTTP2 proxy and a gRPC server.
How severe is CVE-2023-32732?
CVE-2023-32732 has a severity rating of 5.3, which is considered medium.
Which software is affected by CVE-2023-32732?
The affected software includes grpc gem version up to 1.53.0, grpcio pip package up to 1.53.0, and io.grpc:grpc-protobuf maven package up to 1.53.0.
How can I fix CVE-2023-32732?
To fix CVE-2023-32732, it is recommended to upgrade the affected software to version 1.53.1 or higher.
Where can I find more information about CVE-2023-32732?
You can find more information about CVE-2023-32732 on the NIST National Vulnerability Database (NVD) and the GitHub links provided.
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-9hxf-ppjv-w6rq
- alias/CVE-2023-32732
- collector/github-advisory
- agent/type
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/softwarecombine
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/remedy
- agent/title
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/grpc
- canonical/grpc grpc
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38
- package-manager/rubygems
- package-manager/pip
- package-manager/maven
- vendor/ibm
- canonical/ibm cloud pak for business automation
- version/ibm cloud pak for business automation/v23.0.1 - v23.0.1-if001
- version/ibm cloud pak for business automation/v21.0.3 - v21.0.3-if023
- version/ibm cloud pak for business automation/v22.0.2 - v22.0.2-if006 and later fixes v22.0.1 - v22.0.1-if006 and later fixes v21.0.2 - v21.0.2-if012 and later fixes v21.0.1 - v21.0.1-if007 and later fixes v20.0.1 - v20.0.3 and later fixes v19.0.1 - v19.0.3 and later fixes v18.0.0 - v18.0.2 and later fixes