GHSA-2jx2-qcm4-rf9h

Source

https://github.com/advisories/GHSA-2jx2-qcm4-rf9h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-2jx2-qcm4-rf9h/GHSA-2jx2-qcm4-rf9h.json

Aliases

• CVE-2021-36153

Published

2023-06-09T19:32:18Z

Modified

2023-11-08T04:06:12.229659Z

Summary

Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec

Details

Impact

Affected gRPC Swift servers are vulnerable to precondition failures when parsing certain gRPC Web requests. This may lead to a denial of service.

Patches

The problem has been fixed in 1.2.0.

Workarounds

No workaround is available. Users must upgrade.

References

• https://github.com/grpc/grpc-swift/security/advisories/GHSA-2jx2-qcm4-rf9h
• https://nvd.nist.gov/vuln/detail/CVE-2021-36153
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35267
• https://github.com/grpc/grpc-swift
• https://github.com/grpc/grpc-swift/releases