x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-4785 #2062
Description
CVE-2023-4785 references github.com/grpc/grpc, which may be a Go module.
Description:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
References:
- NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-4785
- JSON: https://github.com/CVEProject/cvelist/tree/e5e30ac5d523c38bf8e0379acceeb0b7af558b7c/2023/4xxx/CVE-2023-4785.json
- fix: [iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33656
- fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33667
- fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33669
- fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33670
- fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33672
- Imported by: https://pkg.go.dev/github.com/grpc/grpc?tab=importedby
Cross references:
- Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32731 #1847 NOT_GO_CODE
- Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32732 #1848 NOT_GO_CODE
See doc/triage.md for instructions on how to triage this report.
modules:
- module: github.com/grpc/grpc
vulnerable_at: 1.58.0
packages:
- package: gRPC
description: |-
Lack of error handling in the TCP server in Google's gRPC starting version 1.23
on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial
of service by initiating a significant number of connections with the server.
Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT
affected.
cves:
- CVE-2023-4785
references:
- fix: https://github.com/grpc/grpc/pull/33656
- fix: https://github.com/grpc/grpc/pull/33667
- fix: https://github.com/grpc/grpc/pull/33669
- fix: https://github.com/grpc/grpc/pull/33670
- fix: https://github.com/grpc/grpc/pull/33672