REDHAT-BUG-2510313: Medium severity gRPC gRPC vulnerability
Finding The statically-linked gRPC stack is pinned to v1.46.3 (2022) in the Bazel WORKSPACE file, predating multiple HTTP/2 DoS CVEs that are directly reachable on the network listener:
WORKSPACE:116-117 comgithubgrpcgrpc → gRPC 1.46.3 WORKSPACE:129-130 comgoogleprotobuf → protobuf 3.21.12 WORKSPACE:173-176 zlib → 1.3 The MLMD server is a network-facing gRPC listener (FIND-001: no auth), so gRPC-layer DoS CVEs are directly reachable from any pod that can open a TCP connection to :8080.
The Bazel WORKSPACE pins are content-addressed (sha256), so the issue is staleness, not mutability. Renovate is present (.github/renovate.json) but evidently not covering Bazel httparchive entries.
File: WORKSPACE:116-117,129-130,173-176 Repository: red-hat-data-services/ml-metadata Framework: ASVS V14.2.1; OWASP K8s K07 Vulnerable Components; OpenSSF Scorecard Vulnerabilities CWE: CWE-1395 / CWE-1104 CVSS v3.1: 7.5 (High) AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (inherits gRPC HTTP/2 DoS vectors)
RHOAI Mitigation The DSPO-deployed NetworkPolicy restricts who can reach MLMD port 8080 to only KFP v2 driver pods and DSP components. This limits the attack surface but does not eliminate it — a compromise of a KFP driver pod or DSP component could exploit these CVEs to crash the MLMD pod and disrupt all pipeline runs in the namespace.
Impact An in-cluster attacker who can reach the MLMD pod (within the NetworkPolicy allowlist) can crash or resource-exhaust the MLMD pod via known gRPC/HTTP2 frame-handling bugs, disrupting all pipeline runs in the namespace.
Context ml-metadata is planned for removal from the product (several months out). The stale dependency risk remains active until removal is complete.
Remediation Bump WORKSPACE pins: gRPC >= 1.62, protobuf >= 25.x, zlib >= 1.3.1. Extend Renovate configuration to cover Bazel httparchive entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com_github_grpc_grpcto a version that resolves this vulnerability.Fixed in 1.62 - Upgrade
Upgrade
com_google_protobufto a version that resolves this vulnerability.Fixed in 25.x - Upgrade
Upgrade
zlibto a version that resolves this vulnerability.Fixed in 1.3.1 - Configuration
Extend the Renovate configuration (renovate.json) so it covers Bazel WORKSPACE http_archive pins; this ensures staleness is addressed for the content-addressed sha256 pins.
Renovate Extend configuration to cover Bazel http_archive entries = enabled
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2510313?
The severity of REDHAT-BUG-2510313 is classified as medium with a score of 4.
What are the risks associated with REDHAT-BUG-2510313?
REDHAT-BUG-2510313 involves vulnerabilities in the statically-linked gRPC stack that could be exploited for DoS attacks.
How do I fix REDHAT-BUG-2510313?
To fix REDHAT-BUG-2510313, update the gRPC stack to a version beyond v1.46.3 to mitigate the known vulnerabilities.
Which software is affected by REDHAT-BUG-2510313?
The affected software includes gRPC, Google Protobuf, and zlib.
What vulnerabilities are related to REDHAT-BUG-2510313?
REDHAT-BUG-2510313 is related to multiple HTTP/2 DoS CVEs that impact earlier versions of the gRPC stack.