CVE-2023-32732 Denial-of-Service in gRPC
A malicious client can cause a denial of service by sending malformed base64 headers, disconnecting the gRPC server from HTTP2 proxies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32732?
CVE-2023-32732 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
Weakness: CWE-440
Which versions are affected by CVE-2023-32732?
13 open source packages ship an affected version, including grpcio, io.grpc:grpc-protobuf and grpc. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
grpcio PyPI | From 1.53.0 | 1.53.1, 1.54.2 |
grpcio PyPI | From 1.53.0 | 1.53.1 |
grpcio PyPI | From 1.53.0 | 1.53.1 |
grpcio PyPI | From 1.54.0 | 1.54.2 |
grpcio PyPI | From 1.54.0 | 1.54.2 |
io.grpc:grpc-protobuf Maven | From 1.53.0 | 1.53.1 |
7 more packages
io.grpc:grpc-protobuf Maven | From 1.53.0 | 1.53.1 |
io.grpc:grpc-protobuf Maven | From 1.54.0 | 1.54.2 |
io.grpc:grpc-protobuf Maven | From 1.54.0 | 1.54.2 |
grpc RubyGems | From 1.53.0 | 1.53.1 |
grpc RubyGems | From 1.53.0 | 1.53.1 |
grpc RubyGems | From 1.54.0 | 1.54.2 |
grpc RubyGems | From 1.54.0 | 1.54.2 |
Products include Fedoraproject Fedora, Grpc Grpc.
How do I fix CVE-2023-32732?
Upgrade grpcio to a fixed version for your release line: 1.53.1 or 1.54.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-32732 being exploited?
There is no known exploitation of CVE-2023-32732 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BELL-CVE-2023-32732, DEBIAN-CVE-2023-32732, GHSA-9hxf-ppjv-w6rq, PYSEC-2026-1426, UBUNTU-CVE-2023-32732.