CVE-2023-4785
Assigner: Google
Published: 2023-09-13T16:31:55.664Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Posix-compatible platforms
product: gRPC
repo: https://github.com/grpc/grpc
vendor: Google
versions: lessThan: 1.23
status: unaffected
version: 0
versionType: custom
status: unaffected
version: 1.57
changes: at: 1.56.2
status: unaffected
lessThanOrEqual: 1.56.1
status: affected
version: 1.56.0
versionType: custom
changes: at: 1.55.3
status: unaffected
lessThanOrEqual: 1.55.2
status: affected
version: 1.55.0
versionType: custom
changes: at: 1.54.3
status: unaffected
lessThanOrEqual: 154.2
status: affected
version: 1.54.0
versionType: custom
changes: at: 1.53.2
status: unaffected
lessThanOrEqual: 1.53.1
status: affected
version: 1.53.0
versionType: custom
descriptions: supportingMedia: base64: no
type: text/html
value: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.&nbsp;
value: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. 
impacts: capecId: CAPEC-125
descriptions: value: CAPEC-125 Flooding
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-248
description: CWE-248
type: CWE
source: discovery: UNKNOWN
title: Denial of Service in gRPC Core 
x_generator: engine: Vulnogram 0.1.0-dev