CVE-2023-1428.yml

---
gem: grpc
cve: 2023-1428
ghsa: 6628-q6j9-w8vg
url: https://github.com/grpc/grpc/issues/33463
title: gRPC Reachable Assertion issue
date: 2023-07-06
description: |
  There exists an vulnerability causing an abort() to be called in gRPC.
  The following headers cause gRPC's C++ implementation to abort()
  when called via http2:

  te: x (x != trailers)

  :scheme: x (x != http, https)

  grpclb_client_stats: x (x == anything)

  On top of sending one of those headers, a later header must be sent
  that gets the total header size past 8KB. We recommend upgrading
  past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53
  and above.
cvss_v3: 7.5
patched_versions:
  - ">= 1.53.0"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1428
    - https://github.com/grpc/grpc/issues/33463
    - https://github.com/grpc/grpc/pull/32507
    - https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
    - https://github.com/advisories/GHSA-6628-q6j9-w8vg