Safety CI > giefferre/grpc-usage-example

pyup-update-grpcio-tools-1.35.0-to-1.59.0

1 year, 10 months ago

Update grpcio-tools from 1.35.0 to 1.59.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies.

pyup-update-grpcio-1.35.0-to-1.59.0

1 year, 10 months ago

9bd09ab5

Update grpcio from 1.35.0 to 1.59.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.58.0

1 year, 11 months ago

50530545

Update grpcio-tools from 1.35.0 to 1.58.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies.

pyup-update-grpcio-1.35.0-to-1.58.0

1 year, 11 months ago

eb6c8634

Update grpcio from 1.35.0 to 1.58.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.57.0

2 years ago

c7f88de0

Update grpcio-tools from 1.35.0 to 1.57.0

grpcio 1.35.0 has known security vulnerabilities.

Package	Installed	Affected	Info
grpcio	1.35.0	<1.53.2 , >=1.54.0,<1.54.3 , >=1.55.0,<1.55.2 , >=1.56.0,<1.56.2	show gRPC has a vulnerability linked to hpack table accounting errors, causing potential unwanted disconnects between clients and servers. Identified vectors include unbounded memory buffering and CPU consumption within the HPACK parser, leading to denial-of-service (DOS) attacks. The CPU issue stems from excessive copying, resulting in inefficient parsing. Memory issues arise from delayed header size checks, allowing large strings to be buffered, and a quirk in HPACK's integer encoding, permitting infinite zero-padding. Additionally, metadata overflow checks per frame could enable infinite buffering, compromising gRPC's stability and security.
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Reachable Assertion vulnerability. https://github.com/advisories/GHSA-6628-q6j9-w8vg
grpcio	1.35.0	<1.53.0	show Grpcio 1.53.0 includes a fix for a Connection Confusion vulnerability. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. https://github.com/advisories/GHSA-cfgp-2977-2fmm
grpcio	1.35.0	<1.53.2 , >=1.54.0rc1,<1.54.3 , >=1.55.0rc1,<1.55.3 , >=1.56.0rc1,<1.56.2	show Grpcio 1.53.2, 1.54.3, 1.55.3 and 1.56.2 include a fix for CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. https://github.com/grpc/grpc/pull/33656
grpcio	1.35.0	<1.53.0	show gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies.

pyup-update-grpcio-1.35.0-to-1.57.0

2 years ago

0c8710cb

Update grpcio from 1.35.0 to 1.57.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.56.2

2 years ago

e09ba197

Update grpcio-tools from 1.35.0 to 1.56.2

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.56.2

2 years ago

20addea1

Update grpcio from 1.35.0 to 1.56.2

No dependencies with known security vulnerabilities.

dependabot/pip/client/grpcio-1.53.0

2 years, 1 month ago

e7ff7052

Bump grpcio from 1.35.0 to 1.53.0 in /client Bumps [grpcio](https://github.com/grpc/grpc) from 1.35

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.56.0

2 years, 1 month ago

2345584d

Update grpcio-tools from 1.35.0 to 1.56.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.56.0

2 years, 1 month ago

c1c781ea

Update grpcio from 1.35.0 to 1.56.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.55.0

2 years, 2 months ago

e0c7320e

Update grpcio-tools from 1.35.0 to 1.55.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.55.0

2 years, 2 months ago

f115ff70

Update grpcio from 1.35.0 to 1.55.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.35.0-to-1.54.2

2 years, 2 months ago

97b5870b

Update grpcio-tools from 1.35.0 to 1.54.2

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.35.0-to-1.54.2

2 years, 2 months ago

38e3a8d8

Update grpcio from 1.35.0 to 1.54.2

No dependencies with known security vulnerabilities.