Input validation error in gRPC - CVE-2023-32732

Vulnerability identifier: #VU79796

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32732

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and cause a termination of connection between a HTTP2 proxy and a gRPC server.

gRPC
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Linux Enterprise Micro
Public Cloud Module
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
Development Tools Module
Python 3 Module
SUSE Package Hub 15
openSUSE Leap
Fedora
IBM Observability with Instana
IBM Sterling B2B Integrator
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation
Juniper Cloud Native Router
watsonx.data
IBM Sterling File Gateway
Juniper Secure Analytics (JSA)
IBM Qradar SIEM
opencensus-proto-source
python311-abseil
grpc
libgrpc1_60
libgrpc1_60-debuginfo
grpc-debuginfo
libgrpc++1_60
libgrpc++1_60-debuginfo
libgrpc37
upb-devel
grpc-devel-debuginfo
grpc-devel
libupb37
grpc-debugsource
libupb37-debuginfo
grpc-source
libgrpc37-debuginfo
python311-grpcio
python-grpcio-debugsource
python311-grpcio-debuginfo
python311-protobuf
libprotobuf-lite25_1_0-32bit-debuginfo
libprotoc25_1_0
libprotobuf-lite25_1_0-64bit-debuginfo
libprotoc25_1_0-64bit
libprotobuf25_1_0-64bit-debuginfo
libprotobuf25_1_0-64bit
libprotoc25_1_0-64bit-debuginfo
libprotobuf-lite25_1_0-64bit
libprotobuf-lite25_1_0-32bit
libprotobuf25_1_0-32bit-debuginfo
libprotoc25_1_0-32bit
libprotobuf-lite25_1_0-debuginfo
libprotoc25_1_0-32bit-debuginfo
libprotobuf25_1_0-32bit
libprotoc25_1_0-debuginfo
protobuf-devel
libprotobuf-lite25_1_0
protobuf-java
libprotobuf25_1_0
libprotobuf25_1_0-debuginfo
protobuf-debugsource
protobuf-devel-debuginfo
libabsl2308_0_0-64bit-debuginfo
libabsl2308_0_0-64bit
libabsl2308_0_0-debuginfo
libabsl2308_0_0-32bit
libabsl2308_0_0
libabsl2308_0_0-32bit-debuginfo
abseil-cpp-debugsource
abseil-cpp-devel
libre2-11
re2-debugsource
libre2-11-32bit
libre2-11-32bit-debuginfo
libre2-11-debuginfo
re2-devel
libre2-11-64bit
libre2-11-64bit-debuginfo
IBM Watson Machine Learning Accelerator
Answer Retrieval for Watson Discovery On Prem
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)
Junos cRPD

Install updates from vendor's website.

gRPC - update to 1.53.0
IBM Observability with Instana - update to 1.0.297
watsonx.data - update to 2.2.2
IBM Sterling B2B Integrator - addressed in versions 6.2.0.5.1, 6.2.1.1.1
IBM Sterling File Gateway - addressed in versions 6.2.0.5.1, 6.2.1.1.1
Juniper Secure Analytics (JSA) - update to 7.5.0 UP12 IF03
IBM Qradar SIEM - update to 7.5.0 Update Pack 12 IF03
opencensus-proto-source - update to 0.3.0+git.20200721-150400.9.3.1
python311-abseil - update to 1.4.0-150400.9.3.1
grpc - addressed in versions 1.48.4-8.fc37, 1.48.4-8.fc38, 1.48.4-20.fc39
grpc - update to 1.56.2-10
libgrpc1_60 - update to 1.60.0-150400.8.3.2
libgrpc1_60-debuginfo - update to 1.60.0-150400.8.3.2
grpc-debuginfo - update to 1.60.0-150400.8.3.2
libgrpc++1_60 - update to 1.60.0-150400.8.3.2
libgrpc++1_60-debuginfo - update to 1.60.0-150400.8.3.2
libgrpc37 - update to 1.60.0-150400.8.3.2
upb-devel - update to 1.60.0-150400.8.3.2
grpc-devel-debuginfo - update to 1.60.0-150400.8.3.2
grpc-devel - update to 1.60.0-150400.8.3.2
libupb37 - update to 1.60.0-150400.8.3.2
grpc-debugsource - update to 1.60.0-150400.8.3.2
libupb37-debuginfo - update to 1.60.0-150400.8.3.2
grpc-source - update to 1.60.0-150400.8.3.2
libgrpc37-debuginfo - update to 1.60.0-150400.8.3.2
python311-grpcio - update to 1.60.0-150400.9.3.2
python-grpcio-debugsource - update to 1.60.0-150400.9.3.2
python311-grpcio-debuginfo - update to 1.60.0-150400.9.3.2
python311-protobuf - update to 4.25.1-150400.9.3.1
libprotobuf-lite25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0 - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-64bit - update to 25.1-150400.9.3.1
libprotobuf25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
libprotobuf25_1_0-64bit - update to 25.1-150400.9.3.1
libprotoc25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-64bit - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-32bit - update to 25.1-150400.9.3.1
libprotobuf25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-32bit - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotobuf25_1_0-32bit - update to 25.1-150400.9.3.1
libprotoc25_1_0-debuginfo - update to 25.1-150400.9.3.1
protobuf-devel - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0 - update to 25.1-150400.9.3.1
protobuf-java - update to 25.1-150400.9.3.1
libprotobuf25_1_0 - update to 25.1-150400.9.3.1
libprotobuf25_1_0-debuginfo - update to 25.1-150400.9.3.1
protobuf-debugsource - update to 25.1-150400.9.3.1
protobuf-devel-debuginfo - update to 25.1-150400.9.3.1
libabsl2308_0_0-64bit-debuginfo - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-64bit - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-debuginfo - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-32bit - update to 20230802.1-150400.10.4.1
libabsl2308_0_0 - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-32bit-debuginfo - update to 20230802.1-150400.10.4.1
abseil-cpp-debugsource - update to 20230802.1-150400.10.4.1
abseil-cpp-devel - update to 20230802.1-150400.10.4.1
libre2-11 - update to 20240201-150400.9.3.1
re2-debugsource - update to 20240201-150400.9.3.1
libre2-11-32bit - update to 20240201-150400.9.3.1
libre2-11-32bit-debuginfo - update to 20240201-150400.9.3.1
libre2-11-debuginfo - update to 20240201-150400.9.3.1
re2-devel - update to 20240201-150400.9.3.1
libre2-11-64bit - update to 20240201-150400.9.3.1
libre2-11-64bit-debuginfo - update to 20240201-150400.9.3.1
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
Answer Retrieval for Watson Discovery On Prem - update to 2.12.0
IBM Cloud Pak for Watson AIOps - update to 4.1.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.1
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://github.com/grpc/grpc/pull/32309
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL/

• Multiple vulnerabilities in gRPC
• Fedora 39 update for grpc
• Fedora 38 update for grpc
• Fedora 37 update for grpc
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOps
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• SUSE update for abseil-cpp, grpc, opencensus-proto, protobuf, python-abseil, python-grpcio, re2
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Amazon Linux AMI update for grpc
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics
• Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
• Multiple vulnerabilities in IBM watsonx.data