CVE-2023-32731: Information leak in gRPC
Published Jun 9, 2023
·Updated
gRPC could allow a remote attacker to obtain sensitive information, caused by a flaw when gRPC HTTP2 stack raised a header size exceeded error. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Affected Software
7 affected componentsFixes available
rubygems/grpc<1.53.0
1.53.0
pip/grpcio<1.53.0
1.53.0
maven/io.grpc:grpc-protobuf<1.53.0
1.53.0
IBM Cloud Pak for Business Automation<=V23.0.1 - V23.0.1-IF001
IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF023
IBM Cloud Pak for Business Automation<=V22.0.2 - V22.0.2-IF006 and later fixes
V22.0.1 - V22.0.1-IF006 and later fixes
V21.0.2 - V21.0.2-IF012 and later fixes
V21.0.1 - V21.0.1-IF007 and later fixes
V20.0.1 - V20.0.3 and later fixes
V19.0.1 - V19.0.3 and later fixes
V18.0.0 - V18.0.2 and later fixes
gRPC gRPC>=1.53.0<1.55.0
Remediation
Patch Available
Patch Available
Information
Fixes available in these releases:
- 1.52.2: https://github.com/grpc/grpc/releases/tag/v1.52.2 https://github.com/grpc/grpc/releases/tag/v1.52.2
- 1.53.1: https://github.com/grpc/grpc/releases/tag/v1.53.1 https://github.com/grpc/grpc/releases/tag/v1.53.1
- 1.54.2: https://github.com/grpc/grpc/releases/tag/v1.54.2 https://github.com/grpc/grpc/releases/tag/v1.54.2
- 1.55.0: https://github.com/grpc/grpc/releases/tag/v1.55.0 https://github.com/grpc/grpc/releases/tag/v1.55.0
Event History
Jun 9, 2023
CVE Published
via MITRE·10:54 AM
Data Sourced
via MITRE·10:54 AM
RemedyDescriptionSeverityWeakness
Jun 13, 2023
Data Sourced
via Red Hat·05:57 AM
DescriptionSeverityAffected Software
Jul 5, 2023
Advisory Published
07:12 PM
Jun 30, 2024
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-32731.
2
What is the severity of CVE-2023-32731?
The severity of CVE-2023-32731 is high, with a CVSS score of 7.5.
3
Which software is affected by CVE-2023-32731?
Grpc versions 1.53.0 to 1.55.0 are affected by CVE-2023-32731.
4
What is the impact of CVE-2023-32731?
CVE-2023-32731 can cause a desynchronization of HPACK tables between sender and receiver, leading to potential data inconsistencies.
5
How can I fix CVE-2023-32731?
Update Grpc to a version later than 1.55.0 to mitigate CVE-2023-32731.