SUSE-SU-2024:4429-1

Details

Description of the patch:

This update for python-grpcio fixes the following issues:

CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)

Affected Packages

python311-grpcio

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Public Cloud 15 SP5SUSE Linux Enterprise Module for Python 3 15 SP5SUSE Linux Enterprise Server 15 SP5

Fixed in:

1.60.1-150500.12.6.1

References

ADVISORY

https://bugzilla.suse.com/1228919

ADVISORY

https://bugzilla.suse.com/1233821

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-December/020053.html

ADVISORY

https://www.suse.com/security/cve/CVE-2024-11407/

ADVISORY

https://www.suse.com/security/cve/CVE-2024-7246/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20244429-1/