Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump grpc version #5124

Closed
gauron99 opened this issue Oct 24, 2023 · 0 comments · Fixed by #5132
Closed

Bump grpc version #5124

gauron99 opened this issue Oct 24, 2023 · 0 comments · Fixed by #5132
Assignees
@zroubalik

Comments

@gauron99
Copy link
Contributor

gauron99 commented Oct 24, 2023 •
edited by zroubalik
Loading

Bump gRPC version in go.mod based on https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGGRPC-5953328

Affecting google.golang.org/grpc package, versions <1.56.3 >=1.57.0 <1.57.1 >=1.58.0 <1.58.3

Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zroubalik zroubalik

Labels
None yet
Projects
Roadmap - KEDA Core
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

chore: bump google.golang.org/grpc to mitigate DoS vulnerability zroubalik/keda
2 participants
@zroubalik @gauron99