REDHAT-BUG-2214473
First published: Tue Jun 13 2023(Updated: )
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| gRPC | <v1.53>undefined |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214475
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214474
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214476
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214474#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214475#c2
- https://access.redhat.com/errata/RHSA-2024:10761
- https://bugzilla.redhat.com/show_bug.cgi?id=2214473
Frequently Asked Questions
What is the severity of REDHAT-BUG-2214473?
The severity of REDHAT-BUG-2214473 is considered critical due to the potential for application crashes.
How do I fix REDHAT-BUG-2214473?
To fix REDHAT-BUG-2214473, update to a version of gRPC C++ that is later than v1.53.
What components are affected by REDHAT-BUG-2214473?
REDHAT-BUG-2214473 specifically affects the gRPC C++ implementation.
What conditions trigger the vulnerability REDHAT-BUG-2214473?
The vulnerability REDHAT-BUG-2214473 is triggered when specific HTTP2 headers are sent to gRPC.
Is REDHAT-BUG-2214473 related to security vulnerabilities?
Yes, while REDHAT-BUG-2214473 induces application crashes, it can be exploited in a broader context to affect service reliability.
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-1428
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/grpc
- canonical/grpc