x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-4785

[GoVulnBot]

CVE-2023-4785 references github.com/grpc/grpc, which may be a Go module.

Description:
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. 

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-4785
• JSON: https://github.com/CVEProject/cvelist/tree/e5e30ac5d523c38bf8e0379acceeb0b7af558b7c/2023/4xxx/CVE-2023-4785.json
• fix: [iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33656
• fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33667
• fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33669
• fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33670
• fix: [backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion grpc/grpc#33672
• Imported by: https://pkg.go.dev/github.com/grpc/grpc?tab=importedby

Cross references:

• Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32731 #1847 NOT_GO_CODE
• Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32732 #1848 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/grpc/grpc
      vulnerable_at: 1.58.0
      packages:
        - package: gRPC
description: |-
    Lack of error handling in the TCP server in Google's gRPC starting version 1.23
    on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial
    of service by initiating a significant number of connections with the server.
    Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT
    affected.
cves:
    - CVE-2023-4785
references:
    - fix: https://github.com/grpc/grpc/pull/33656
    - fix: https://github.com/grpc/grpc/pull/33667
    - fix: https://github.com/grpc/grpc/pull/33669
    - fix: https://github.com/grpc/grpc/pull/33670
    - fix: https://github.com/grpc/grpc/pull/33672

[gopherbot]

Change https://go.dev/cl/528596 mentions this issue: data/excluded: batch add 10 excluded reports