Safety CI > giefferre/grpc-usage-example

pyup-update-grpcio-tools-1.35.0-to-1.64.1

2 years, 1 month ago

Update grpcio-tools from 1.35.0 to 1.64.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.64.1

2 years, 1 month ago

ba4229fd

Update grpcio from 1.35.0 to 1.64.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.64.0

2 years, 2 months ago

82bd8b9c

Update grpcio-tools from 1.35.0 to 1.64.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.64.0

2 years, 2 months ago

807283c1

Update grpcio from 1.35.0 to 1.64.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.63.0

2 years, 2 months ago

851fc155

Update grpcio-tools from 1.35.0 to 1.63.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.63.0

2 years, 2 months ago

96bb89df

Update grpcio from 1.35.0 to 1.63.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.62.2

2 years, 3 months ago

7f09c857

Update grpcio-tools from 1.35.0 to 1.62.2

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.62.2

2 years, 3 months ago

47d05f18

Update grpcio from 1.35.0 to 1.62.2

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.62.1

2 years, 4 months ago

beb3df5b

Update grpcio-tools from 1.35.0 to 1.62.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.62.1

2 years, 4 months ago

9171875c

Update grpcio from 1.35.0 to 1.62.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.62.0

2 years, 5 months ago

26959698

Update grpcio from 1.35.0 to 1.62.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.62.0

2 years, 5 months ago

019f2416

Update grpcio-tools from 1.35.0 to 1.62.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-tools-1.35.0-to-1.60.1

2 years, 5 months ago

949a4c40

Update grpcio-tools from 1.35.0 to 1.60.1

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656

pyup-update-grpcio-1.35.0-to-1.60.1

2 years, 5 months ago

1a358d9b

Update grpcio from 1.35.0 to 1.60.1

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.60.0

2 years, 7 months ago

32043653

Update grpcio from 1.35.0 to 1.60.0

No dependencies with known security vulnerabilities.