p PatchFirst

CVE-2024-37168

CVE-2024-37168 · @grpc/grpc-js can allocate memory for incoming messages well above configured limits

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

CVSS 5.3 · Media · EPSS 0,7% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • grpc-node

    Versiones
    • >= 1.10.0, < 1.10.9: Afectada
    • >= 1.9.0, < 1.9.15: Afectada
    • < 1.8.22: Afectada

    Sin corrección publicada

  • @grpc/grpc-js npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 1.10.0, < 1.10.9

    Actualiza a 1.10.9

  • @grpc/grpc-js npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 1.9.0, < 1.9.15

    Actualiza a 1.9.15

  • @grpc/grpc-js npm

    Intervalos de versiones afectados
    • SEMVER: < 1.8.22

    Actualiza a 1.8.22

Fuentes originales

Comprueba tu servidor →