Safety CI > giefferre/grpc-usage-example

pyup-update-grpcio-tools-1.35.0-to-1.84.0

2 weeks ago

Update grpcio-tools from 1.35.0 to 1.84.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.84.0

2 weeks ago

d6438e2c

Update grpcio from 1.35.0 to 1.84.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.83.1

1 month ago

93275af5

Update grpcio-tools from 1.35.0 to 1.83.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.83.1

1 month ago

5731de3c

Update grpcio from 1.35.0 to 1.83.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.83.0

2 months ago

e5e236e3

Update grpcio-tools from 1.35.0 to 1.83.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.83.0

2 months ago

60887c09

Update grpcio from 1.35.0 to 1.83.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.82.1

2 months, 3 weeks ago

e74a0ba4

Update grpcio-tools from 1.35.0 to 1.82.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.82.1

2 months, 3 weeks ago

6c4978d1

Update grpcio from 1.35.0 to 1.82.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.82.0

2 months, 3 weeks ago

24550dcd

Update grpcio-tools from 1.35.0 to 1.82.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.82.0

2 months, 3 weeks ago

a0f6ab68

Update grpcio from 1.35.0 to 1.82.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.81.1

3 months, 2 weeks ago

fef865d9

Update grpcio-tools from 1.35.0 to 1.81.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.81.1

3 months, 2 weeks ago

54f41b31

Update grpcio from 1.35.0 to 1.81.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.81.0

3 months, 4 weeks ago

2e72f022

Update grpcio-tools from 1.35.0 to 1.81.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.

pyup-update-grpcio-1.35.0-to-1.81.0

3 months, 4 weeks ago

73f62e9d

Update grpcio from 1.35.0 to 1.81.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.80.0

6 months ago

574c96fc

Update grpcio-tools from 1.35.0 to 1.80.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.