New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Rust crate tonic to 0.12.3 [SECURITY] - autoclosed #22

Closed

renovate wants to merge 1 commit into master from renovate/crate-tonic-vulnerability

renovate bot commented Oct 2, 2024 •

edited

Loading

This PR contains the following updates:

Package	Type	Update	Change
tonic	dependencies	minor	`0.4` -> `0.12.3`

GitHub Vulnerability Alerts

CVE-2024-47609

Impact

note: this only affects v0.12.0 - v0.12.2

When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit.

More information can be found here

Patches

Upgrading to tonic 0.12.3 and above contains the fix.

Workarounds

A custom accept loop is a possible workaround.

Release Notes

hyperium/tonic (tonic)

`v0.12.3`

Features

server: Added support for grpc max_connection_age (#1865)
build: Add #[deprecated] to deprecated client methods (#1879)
build: plumb skip_debug through prost Builder and add test (#1900)

Bug Fixes

build: Revert "fix tonic-build cargo build script outputs (#1821)" which accidentally increases MSRV (#1898)
server: ignore more error kinds in incoming socket stream (#1885)
transport: do not shutdown server on broken connections (#1948)

`v0.12.2`

Features

Move TimeoutExpired out of transport (#1826)
Move ConnectError type from transport (#1828)
channel: allow setting max_header_list_size (#1835)
router: Add RoutesBuilder constructor (#1855)
tls: Rename tls-roots feature with tls-native-roots (#1860)
router: Rename Routes::into_router with into_axum_router (#1862)
router: Implement from axum::Router for Routes (#1863)
channel: Re-enable TLS based on Cargo features in generated clients (#1866)
server: allow setting max_header_list_size (#1870)
build: Expose formatted service name (#1684)
reflection: add back support for v1alpha reflection protocol (#1888)

Bug Fixes

router: Add missing unimplemented fallback to RoutesBuilder (#1864)
server: Prevent server from exiting on ECONNABORTED (#1874)
web: fix panic in trailer parsing on multiple trailers (#1880)
web: fix empty trailer parsing causing infinite parser loop (#1883)

`v0.12.1`

Bug Fixes

Reduce tokio-stream feature (#1795)

`v0.12.0`

This breaking release updates tonic to the hyper 1.0 ecosystem and also updates
to prost v0.13.0.

Features

build: Custom codecs for generated code (#1599) (18a2b30)
channel: Make channel feature additive (#1574) (b947e1a)
codec: Make error when not utf8 value in compression encoding (#1768) (f8e1f87)
Implement http_body::Body::size_hint for custom body (#1713) (9728c01)
Make boxed function public (#1754) (2cc868f)
Relax GrpcMethod lifetime (#1598) (68bf17d)
tls: Add ability to add multiple ca certificates (#1724) (3457f92)
tls: Use rustls_pki_types::CertificateDer to describe DER encoded certificate (#1707) (96a8cbc)
tls: Remove tls roots implicit configuration (#1731) (de73617)
transport: Make service router independent from transport (#1572) (da48235)
transport: Make transport server and channel independent (#1630) (654289f)
transport: Rename reexported axum body (#1752) (5d7bfc2)
Use http::Extensions directly (#1710) (ed95d27)

Bug Fixes

tonic: flush accumulated ready messages when status received (#1756) (d312dcc), closes #1423

BREAKING CHANGES

tonic and crates updated to hyper 1.0 (#1670)
tonic and crates updated to prost 0.13 (#1779)
tonic_reflection::server is updated to use the generated
tonic_reflection::pb::v1 code.
Make compression encoding configuration more malleable (#1757)
Removed implicit configuration of client TLS roots setup (#1731)

`v0.11.0`

BREAKING CHANGES:

Removed NamedService from the transport module, please import it via
tonic::server::NamedService.
MSRV bumped to 1.70.

Features

Added zstd compression support.
Added connection timeout for connecto_with_connector_lazy.
Upgrade rustls to v0.22
Feature gate server implementation for tonic-reflection.

`v0.10.2`

Bug Fixes

web: Client decoding incomplete buffer bug (#1540) (83e363a)

`v0.10.1`

Bug Fixes

web: Buffer incomplete messages (#1528) (fe6f8d9)

`v0.10.0`

Bug Fixes

codegen: Use stream type from codegen mod (#1446) (60d776b)
examples: Use https scheme when using tls (#1466) (388b177)
tls: Don't use tls w/ http scheme (#1454) (95e81f5)

Features

build: Add optional default unimplemented stubs (#1344) (aff1daf)
core: amortize many ready messages into fewer, larger buffers (#1423) (76eedc1)
tonic-types: add ability to extract rich error details from google.rpc.Status (#1430) (5fd635a)
transport: Add Router::into_router (#1442) (ea06a1b)
transport: Expose TcpConnectInfo fields (#1449) (74b079c)
web: Add GrpcWebClientService (#1472) (dc29c17)

0.9.2 (2023-04-17)

0.9.1 (2023-04-03)

`v0.9.2`

`v0.9.1`

`v0.9.0`

Bug Fixes

build: Allow Services to be named Result (#1203) (a562a3c), closes #1156
codec: Cancelled client streaming handling (#1315) (c8027a1), closes #848
MetadataKey::from_bytes returns an error (#1246) (930c805)
web: Fix enable and update docs (#1326) (a9db219)

Features

add GrpcMethod extension into request for client (#1275) (7a6b20d)
build: Builder: add {enum,message}_attributes (#1234) (ff642f9)
codec: Configure max request message size (#1274) (9f716d8), closes #1097
core: Default encoding/decoding limits (#1335) (ff33119)
reflection: Add dummy implementation for extension (#1209) (fdff111)
Rename api related to protobuf (#1224) (d2542dc)
tls: add an option for optional TLS client authentication (#1163) (773e4e1), closes #687
tonic: Use NamedService without transport feature (#1273) (5acde56)
transport: Addlocal_addr to Request o (#1327) (b54ce23)
transport: added support for EC keys (#1145) (17d6a4b), closes #1143
types: Add gRPC Richer Error Model support (Docs) (#1317) (69ce71e)
types: Add gRPC Richer Error Model support (Examples) (#1300) (d471212)
types: Add gRPC Richer Error Model support (Help) (#1293) (d6041a9)
types: Add gRPC Richer Error Model support (LocalizedMessage) (#1295) (d54d02d)
types: Add gRPC Richer Error Model support (PreconditionFailure) (#1276) (2378581)
types: Add gRPC Richer Error Model support (QuotaFailure) (#1204) (03b4735)
types: Add gRPC Richer Error Model support (ResourceInfo) (#1282) (7eeda24)
types: Add gRPC Richer Error Model support (RetryInfo) (#1095) (6cdb3d4)
types: add support for DebugInfo error message type (#1179) (3076e82)
types: Expose FILE_DESCRIPTOR_SET (#1210) (cc42d1f)

0.8.4 (2022-11-29)

Bug Fixes

build: Fix CodeGen8uilder typo (#1165) (#1166) (c7476ff)

0.8.3 (2022-11-28)

Bug Fixes

do not panic while encoding oversized bodies (#1142) (33e22bb), closes #1141
reflection, health: Remove transport feature (#1112) (7153289)

Features

build: Add build_transport builder option (#1130) (1f5bc9b)
build: Add CodeGenBuilder (#1154) (c4525ba)
build: Add disable_comments option (#1127) (e188521)
Expose Request#into_parts and Request#from_parts (#1118) (b409ddd)
transport: add from_listener for TcpIncoming (#1093) (0b03b30)
web: Implement tower::Layer for tonic_web::Config (#1119) (40536dc)
web: Removed Cors impl and replaced with tower-http's CorsLayer (#1123) (a98d719), closes #1122

0.8.2 (2022-09-28)

Bug Fixes

transport: Bump axum for CVE-2022-3212 (#1088) (cddd992)

Features

add Result<T> type alias for std::result::Result<T, tonic::Status> (#1085) (56ff45d)
build: add cleanup-markdown feature flag (#1086) (c1b08df)
tonic: impl Clone for Status using Arc (#1076) (ee3d0df)
transport: Expose hyper's H2 adaptive window on server (#1071) (919d28b)
types: Add gRPC Richer Error Model support (BadRequest) (#1068) (3e40d81), closes /github.com/hyperium/tonic/pull/1068#discussion_r956117520

`v0.8.3`

Bug Fixes

do not panic while encoding oversized bodies (#1142) (33e22bb), closes #1141
reflection, health: Remove transport feature (#1112) (7153289)

Features

build: Add build_transport builder option (#1130) (1f5bc9b)
build: Add CodeGenBuilder (#1154) (c4525ba)
build: Add disable_comments option (#1127) (e188521)
Expose Request#into_parts and Request#from_parts (#1118) (b409ddd)
transport: add from_listener for TcpIncoming (#1093) (0b03b30)
web: Implement tower::Layer for tonic_web::Config (#1119) (40536dc)
web: Removed Cors impl and replaced with tower-http's CorsLayer (#1123) (a98d719), closes #1122

`v0.8.2`

Bug Fixes

transport: Bump axum for CVE-2022-3212 (#1088) (cddd992)

Features

add Result<T> type alias for std::result::Result<T, tonic::Status> (#1085) (56ff45d)
build: add cleanup-markdown feature flag (#1086) (c1b08df)
tonic: impl Clone for Status using Arc (#1076) (ee3d0df)
transport: Expose hyper's H2 adaptive window on server (#1071) (919d28b)
types: Add gRPC Richer Error Model support (BadRequest) (#1068) (3e40d81), closes /github.com/hyperium/tonic/pull/1068#discussion_r956117520

`v0.8.1`

`v0.8.0`

Features

Add Grpc::with_origin for clients (#1017) (10f6d2f)
build: Add option to emit rerun-if-changed instructions (#1021) (1d2083a)
build: Better support for custom codecs (#999) (de2e4ac)
Decouple NamedService from the transport feature (#969) (feae96c)

BREAKING CHANGES

build: CODEC_PATH moved from const to fn

0.7.2 (2022-05-05)

Bug Fixes

build: Reduce Default bound requirement (#974) (4533a6e)
don't enable default features in tower (#972) (b4f9634)
transport: Emit HttpsUriWithoutTlsSupport only w/ tls feat (#996) (1dd5ad2)

Features

Add TryFrom implementations for MetadataValue (#990) (edc5a0d)

0.7.1 (2022-04-04)

Features

transport: Add channel feature flag (#960) (f1ca90f)

`v0.7.2`

Bug Fixes

build: Reduce Default bound requirement (#974) (4533a6e)
don't enable default features in tower (#972) (b4f9634)
transport: Emit HttpsUriWithoutTlsSupport only w/ tls feat (#996) (1dd5ad2)

Features

Add TryFrom implementations for MetadataValue (#990) (edc5a0d)

`v0.7.1`

Features

transport: Add channel feature flag (#960) (f1ca90f)

`v0.7.0`

Bug Fixes

build: clippy warning for must_use (#892) (a337f13)
codec: Remove Default bound on Codec (#894) (d574cfd)
codec: Return None after poll_data error (#921) (d7cae70)
Handle interceptor errors as responses (#840) (#842) (bf44940)
health: Correctly implement spec for overall health (#897) (2b0ffee)
Return error on non https uri instead of panic (#838) (ef6e245)
tonic: Expose h2 error instead of reason (#883) (a33e15a)
tonic: Preserve HTTP method in interceptor (#912) (e623562)
transport: connect w/ connector infailable (#922) (a197c20)
transport: Endpoint returns transport error (#920) (ee6e726)
transport: Make Server::layer() support more than one layer (#932) (e30bb7e)
transport: Make server builder more consitient (#901) (6763d19)
web: Fix error tonic-web doc url (#928) (37cd483)

Features

build: add constructor from_arc for gRPC servers (#875) (7179f7a)
build: Expose Prost generation plugin (#947) (d4bd475)
build: use prettyplease to format output (#890) (#904) (d6c0fc1)
health: Expose HealthService publically (#930) (097e7e8)
Implement hash for Code (#917) (6bc7dab)
tls: upgrade to tokio-rustls 0.23 (rustls 0.20) (#859) (4548997)
transport: add unix socket support in server (#861) (dee2ab5)
transport: port router to axum (#830) (6dfc20e)
transport: support customizing Channel's async executor (#935) (0859d82)
Update prost to 0.10 (#948) (c78274e)

0.6.2 (2021-12-08)

Bug Fixes

examples: Fix autoreload example (#798) (#818) (8508f36)

0.6.1 (2021-10-27)

Bug Fixes

transport: Bump hyper to 0.14.14 (#813) (2a3e9b2)

`v0.6.2`

Bug Fixes

examples: Fix autoreload example (#798) (#818) (8508f36)

`v0.6.1`

Bug Fixes

transport: Bump hyper to 0.14.14 (#813) (2a3e9b2)

`v0.6.0`

Bug Fixes

build: Correctly convert Empty to () (#734) (ff6a690)
build: split path types in compile (#721) (53ecc1f)
tonic: change connect_lazy to be infallible (#712) (2e47154)
tonic: fix extensions disappearing during streaming requests (5c1bb90), closes #770
tonic: Remove Sync requirement for streams (#804) (23c1392)
tonic: Status code to set correct source on unkown error (#799) (4054d61)
transport: AddOrigin panic on invalid uri (#801) (3ab00f3)
transport: Correctly map hyper errors (#629) (4947b07)

Features

build: Support prost's include_file option (#774) (3f9ab80)
Update prost and friends to 0.9 (#791) (09805ec)

0.5.2 (2021-08-10)

0.5.1 (2021-08-09)

Bug Fixes

build: allow services to be named Service (#709) (380d81d)
build: remove unnecessary Debug constraint for client streams (#719) (167e8cb)

Features

examples: add grpc-web example (#710) (5aa8ae1)
health: Expose grpc_health_v1 file descriptor set (#620) (6ee638d)
tonic: add Interceptor trait (#713) (8c8f4d1)
transport: Add Connected impl for DuplexStream (#722) (0e33a02)

`v0.5.2`

`v0.5.1`

Bug Fixes

build: allow services to be named Service (#709) (380d81d)
build: remove unnecessary Debug constraint for client streams (#719) (167e8cb)

Features

examples: add grpc-web example (#710) (5aa8ae1)
health: Expose grpc_health_v1 file descriptor set (#620) (6ee638d)
tonic: add Interceptor trait (#713) (8c8f4d1)
transport: Add Connected impl for DuplexStream (#722) (0e33a02)

`v0.5.0`

Bug Fixes

build: fix with_interceptor not building on Rust 1.51 (#669) (9478fac)
codec: Fix streaming reponses w/ many status (#689) (737ace3), closes #681
codec: improve error message for invalid compression flag (#663) (9cc14b7)
examples: Fix tower examples (#624) (4a917a3)
tonic: don't include error's cause in Display impl (#633) (31a3468)
tonic: don't remove reserved headers in interceptor (#701) (6711b80)
tonic: make Interceptor UnwindSafe (#641) (57509d3)
transport: remove needless BoxFuture (#644) (74ad0a9)
web: fix compilation (#670) (e199387)

Features

build: support adding attributes to clients and servers (#684) (a948a8f)
codec: compression support (#692) (0583cff)
metadata: expose IterMut and ValuesMut (#639) (b0ec3ea)
metadata: remove manual Send + Sync impls for metadata types (#640) (e97f518)
tonic-web: implement grpc <-> grpc-web protocol translation (#455) (c309063)
tonic: add h2::Error as a source for Status (#612) (b90bb7b)
tonic: add Request and Response extensions (#642) (352b0f5)
tonic: expose setting for http2_adaptive_window (#657) (12815d0)
tonic: implement From<Code> for i32 (f33316d)
tonic: make it easier to add tower middleware to servers (#651) (4d2667d)
tonic: pass trace_fn the request rather than just the headers (#634) (7862a22)
tonic: Use BoxBody from http-body crate (#622) (4dda4cb)
transport: Add connect_with_connector_lazy (#696) (2a46ff5), closes #695
transport: Add a tls-webpki-roots feature to add trust roots from webpki-roots (#660) (32173dc)
transport: add connect timeout to Endpoint (#662) (2b60a00)
transport: provide generic access to connect info (#647) (e5e3118)

0.4.3 (2021-04-29)

Features

tonic: Add Request::set_timeout (#615) (dae31d0)
transport: Support timeouts with "grpc-timeout" header (#606) (9ff4f7b)

0.4.2 (2021-04-13)

Bug Fixes

codec: Allocate inbound buffer once (#578) (1d2754f)
reflection: Depend on correct version of build (#582) (db09093)

Features

build: Add prostoc_args (#577) (480a794)
Expose status constructors (#579) (0d05aa0)
health: Expose proto and client (#471) (#602) (49f6137)

Reverts

Revert "Remove grpc-timeout header from reserved headers (#603)" (7aaa2f8), closes #603

0.4.1 (2021-03-16)

Bug Fixes

Depend on at least tower 0.4.4 (#554) (ca3b9a1), closes #553 #552 #553 #552

Features

build: Add disable_package_emission option to tonic-build (#556) (4f5e160)
build: Support compiling well-known protobuf types (#522) (61555ff)
build: Use RUSTFMT to find rustfmt binary (#566) (ea56e2e)
Implement gRPC Reflection Service (#340) (c54f247)

`v0.4.3`

Features

tonic: Add Request::set_timeout (#615) (dae31d0)
transport: Support timeouts with "grpc-timeout" header (#606) (9ff4f7b)

`v0.4.2`

Bug Fixes

codec: Allocate inbound buffer once (#578) (1d2754f)
reflection: Depend on correct version of build (#582) (db09093)

Features

build: Add prostoc_args (#577) (480a794)
Expose status constructors (#579) (0d05aa0)
health: Expose proto and client (#471) (#602) (49f6137)

Reverts

Revert "Remove grpc-timeout header from reserved headers (#603)" (7aaa2f8), closes #603

`v0.4.1`

Bug Fixes

Depend on at least tower 0.4.4 (#554) (ca3b9a1), closes #553 #552 #553 #552

Features

build: Add disable_package_emission option to tonic-build (#556) (4f5e160)
build: Support compiling well-known protobuf types (#522) (61555ff)
build: Use RUSTFMT to find rustfmt binary (#566) ([ea56e2e](https://redirect.github.com/hyperium/tonic/commit/ea56e2e2b89d45c95c60152cbe5e4338e

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update Rust crate tonic to 0.12.3 [SECURITY]

7202ab0

renovate bot added the B-renovate label

renovate bot changed the title ~~Update Rust crate tonic to 0.12.3 [SECURITY]~~ Update Rust crate tonic to 0.12.3 [SECURITY] - autoclosed

renovate bot closed this

renovate bot deleted the renovate/crate-tonic-vulnerability branch

October 2, 2024 18:40

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels