CVE-2024-7246mediumCWE-440

CVE-2024-7246: falha de média gravidade em Google gRPC

HPACK table poisoning in gRPC C++, Python & Ruby

Publicada em

Seguir esta CVE+ Monitorar gRPC+ Monitorar grpc

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Produtos afetados
Google · gRPC
CVEs relacionadas — Google gRPC

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4785HIGHDenial of Service in gRPC CoreEPSS 0.8%CVE-2023-32732MEDIUMDenial-of-Service in gRPCEPSS 0.5%CVE-2023-32731HIGHInformation leak in gRPCEPSS 0.5%CVE-2023-33953HIGHDenial-of-Service in gRPCEPSS 0.5%CVE-2023-1428HIGHDenial-of-Service in gRPCEPSS 0.4%