CVE-2023-32732

Advisory

Grpcio 1.53.0 includes a fix for a Connection Termination vulnerability. The prior versions contain a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies.
https://github.com/advisories/GHSA-9hxf-ppjv-w6rq

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://pypi.org/project/grpcio
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32732
• https://github.com/grpc/grpc/pull/32309
• https://lists.fedoraproject.org/archives/list/[email protected]/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL/