CVE-2023-32732: Denial-of-Service in gRPC
Published Jun 9, 2023
·Updated
Denial-of-Service in gRPC
Affected Software
9 affected componentsFixes available
rubygems/grpc<1.53.0
1.53.0
pip/grpcio<1.53.0
1.53.0
maven/io.grpc:grpc-protobuf<1.53.0
1.53.0
IBM Cloud Pak for Business Automation<=V23.0.1 - V23.0.1-IF001
IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF023
IBM Cloud Pak for Business Automation<=V22.0.2 - V22.0.2-IF006 and later fixes
V22.0.1 - V22.0.1-IF006 and later fixes
V21.0.2 - V21.0.2-IF012 and later fixes
V21.0.1 - V21.0.1-IF007 and later fixes
V20.0.1 - V20.0.3 and later fixes
V19.0.1 - V19.0.3 and later fixes
V18.0.0 - V18.0.2 and later fixes
gRPC gRPC<1.53.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Remediation
Patch Available
Information
Fixes available in these releases:
- 1.52.2: https://github.com/grpc/grpc/releases/tag/v1.52.2 https://github.com/grpc/grpc/releases/tag/v1.52.2
- 1.53.1: https://github.com/grpc/grpc/releases/tag/v1.53.1 https://github.com/grpc/grpc/releases/tag/v1.53.1
- 1.54.2: https://github.com/grpc/grpc/releases/tag/v1.54.2 https://github.com/grpc/grpc/releases/tag/v1.54.2
- 1.55.0: https://github.com/grpc/grpc/releases/tag/v1.55.0 https://github.com/grpc/grpc/releases/tag/v1.55.0
Event History
Jun 9, 2023
CVE Published
via MITRE·10:48 AM
Data Sourced
via MITRE·10:48 AM
RemedyDescriptionSeverityWeakness
Jul 6, 2023
Advisory Published
09:15 PM
Jun 30, 2024
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-32732?
CVE-2023-32732 is a vulnerability in gRPC that allows a client to cause a termination of connection between a HTTP2 proxy and a gRPC server.
2
How severe is CVE-2023-32732?
CVE-2023-32732 has a severity rating of 5.3, which is considered medium.
3
Which software is affected by CVE-2023-32732?
The affected software includes grpc gem version up to 1.53.0, grpcio pip package up to 1.53.0, and io.grpc:grpc-protobuf maven package up to 1.53.0.
4
How can I fix CVE-2023-32732?
To fix CVE-2023-32732, it is recommended to upgrade the affected software to version 1.53.1 or higher.
5
Where can I find more information about CVE-2023-32732?
You can find more information about CVE-2023-32732 on the NIST National Vulnerability Database (NVD) and the GitHub links provided.