rpm package
suse/python-grpcio&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6
pkg:rpm/suse/python-grpcio&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP6
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-11407 | Hig | 7.5 | < 1.60.1-150600.16.8.1 | 1.60.1-150600.16.8.1 | Nov 26, 2024 | There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmi | |
| CVE-2024-7246 | Med | 5.3 | < 1.60.1-150600.16.8.1 | 1.60.1-150600.16.8.1 | Aug 6, 2024 | It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This oc | |
| CVE-2023-29483 | Hig | 7.0 | < 1.60.1-150600.16.10.1 | 1.60.1-150600.16.10.1 | Apr 11, 2024 | eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred |
- affected < 1.60.1-150600.16.8.1fixed 1.60.1-150600.16.8.1
There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmi
- affected < 1.60.1-150600.16.8.1fixed 1.60.1-150600.16.8.1
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This oc
- affected < 1.60.1-150600.16.10.1fixed 1.60.1-150600.16.10.1
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred