PRIOn knowledge basePRION:CVE-2023-4785

HistorySep 13, 2023 - 5:15 p.m.

Code injection

2023-09-1317:15:00

PRIOn knowledge base

www.prio-n.com

code injection

error handling

grpc

tcp server

denial of service

posix-compatible

linux

c++

python

ruby

java

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.8%

JSON

Lack of error handling in the TCP server in Google’s gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

CPENameOperatorVersion
grpcge1.54.0
grpclt1.54.3
grpcge1.23.0
grpclt1.53.2
grpcge1.55.0
grpclt1.55.3
grpceq1.56.0

Name	Operator	Version
grpc	ge	1.54.0
grpc	lt	1.54.3
grpc	ge	1.23.0
grpc	lt	1.53.2
grpc	ge	1.55.0
grpc	lt	1.55.3
grpc	eq	1.56.0

References

github.com/grpc/grpc/pull/33656

github.com/grpc/grpc/pull/33667

github.com/grpc/grpc/pull/33669

github.com/grpc/grpc/pull/33670

github.com/grpc/grpc/pull/33672