GitHub Advisoryadvisory · SwiftURL

GHSA-rxmj-hg9v-vp3p Uncontrolled Resource Consumption in LengthPrefixedMessageReader

HIGH Published 2023-06-09 Modified 2023-06-09 Official page ↗
Aliases
CVE-2021-36155
Ecosystem
SwiftURL
Packages
github.com/grpc/grpc-swift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-120, CWE-770
Reviewed
2023-06-09

Affected packages

• SwiftURL github.com/grpc/grpc-swift: < 1.2.0 → fixed in 1.2.0

Description

Impact Affected gRPC Swift clients and servers are vulnerable to uncontrolled resource consumption attacks. Excessive memory may be allocated when parsing messages. This can lead to a denial of service. Patches The problem has been fixed in 1.2.0. Workarounds No workaround is available. Users must upgrade.

Related

Alias · CVE (1)

  • CVE-2021-36155 LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause… vulnerability

Weakness · CWE (2)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References