2 lines
5.8 KiB
JSON
2 lines
5.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Posix-compatible platforms"],"product":"gRPC","repo":"https://github.com/grpc/grpc","vendor":"Google","versions":[{"lessThan":"1.23","status":"unaffected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.57"},{"changes":[{"at":"1.56.2","status":"unaffected"}],"lessThanOrEqual":"1.56.1","status":"affected","version":"1.56.0","versionType":"custom"},{"changes":[{"at":"1.55.3","status":"unaffected"}],"lessThanOrEqual":"1.55.2","status":"affected","version":"1.55.0","versionType":"custom"},{"changes":[{"at":"1.54.3","status":"unaffected"}],"lessThanOrEqual":"1.54.2","status":"affected","version":"1.54.0","versionType":"custom"},{"changes":[{"at":"1.53.2","status":"unaffected"}],"lessThanOrEqual":"1.53.1","status":"affected","version":"1.53.0","versionType":"custom"}]}],"source":"cve-coordination@google.com"},{"affectedData":[{"cpes":["cpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"grpc","vendor":"grpc","versions":[{"lessThan":"1.23","status":"affected","version":"0","versionType":"custom"},{"status":"affected","version":"1.57"},{"lessThanOrEqual":"1.56.1","status":"affected","version":"1.56.0","versionType":"custom"},{"lessThanOrEqual":"155.2","status":"affected","version":"1.55.0","versionType":"custom"},{"lessThanOrEqual":"1.54.2","status":"affected","version":"1.54.0","versionType":"custom"},{"lessThanOrEqual":"1.53.1","status":"affected","version":"1.53.0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*","matchCriteriaId":"988AD4A4-5F77-4474-B06B-7677D748F1AC","versionEndExcluding":"1.53.2","versionStartIncluding":"1.23.0","vulnerable":true},{"criteria":"cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*","matchCriteriaId":"1A6B7840-8878-4F83-977A-1AF53E103F51","versionEndExcluding":"1.54.3","versionStartIncluding":"1.54.0","vulnerable":true},{"criteria":"cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*","matchCriteriaId":"75EDD526-0BB3-43B4-9158-B3D9593E7368","versionEndExcluding":"1.55.3","versionStartIncluding":"1.55.0","vulnerable":true},{"criteria":"cpe:2.3:a:grpc:grpc:1.56.0:*:*:*:*:-:*:*","matchCriteriaId":"DB59E93E-4F0B-49D7-AD20-AC7B3A151195","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected."},{"lang":"es","value":"La falta de manejo de errores en el servidor TCP en gRPC de Google a partir de la versión 1.23 en plataformas compatibles con posix (por ejemplo, Linux) permite a un atacante provocar una denegación de servicio al iniciar una cantidad significativa de conexiones con el servidor. Tenga en cuenta que gRPC C++ Python y Ruby se ven afectados, pero gRPC Java y Go NO se ven afectados."}],"id":"CVE-2023-4785","lastModified":"2026-06-17T06:38:35.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cve-coordination@google.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-4785","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-09-25T18:02:01.004344Z","version":"2.0.3"}}]},"published":"2023-09-13T17:15:10.227","references":[{"source":"cve-coordination@google.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/grpc/grpc/pull/33656"},{"source":"cve-coordination@google.com","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33667"},{"source":"cve-coordination@google.com","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33669"},{"source":"cve-coordination@google.com","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33670"},{"source":"cve-coordination@google.com","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33672"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"url":"https://github.com/grpc/grpc/pull/33656"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33667"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33669"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33670"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/grpc/grpc/pull/33672"}],"sourceIdentifier":"cve-coordination@google.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"cve-coordination@google.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
|