SUSE-SU-2024:4436-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2024:4436-1

MEDIUM5.8

Security update for grpc

Published Dec 30, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for grpc fixes the following issues:

CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)

Affected Packages

grpc-devel

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Basesystem 15 SP5SUSE Linux Enterprise Server 15 SP5SUSE Linux Enterprise Server for SAP Applications 15 SP5

Fixed in:

1.60.0-150500.11.8.1

libgrpc++1_60

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Basesystem 15 SP5SUSE Linux Enterprise Server 15 SP5SUSE Linux Enterprise Server for SAP Applications 15 SP5

Fixed in:

1.60.0-150500.11.8.1

libgrpc1_60

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Basesystem 15 SP5SUSE Linux Enterprise Module for Public Cloud 15 SP5SUSE Linux Enterprise Server 15 SP5

Fixed in:

1.60.0-150500.11.8.1

libgrpc37

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Basesystem 15 SP5SUSE Linux Enterprise Module for Public Cloud 15 SP5SUSE Linux Enterprise Server 15 SP5

Fixed in:

1.60.0-150500.11.8.1

libupb37

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Basesystem 15 SP5SUSE Linux Enterprise Module for Public Cloud 15 SP5SUSE Linux Enterprise Server 15 SP5

Fixed in:

1.60.0-150500.11.8.1

grpc-source

openSUSE Leap 15.5

Fixed in:

1.60.0-150500.11.8.1

upb-devel

openSUSE Leap 15.5

Fixed in:

1.60.0-150500.11.8.1

References

https://bugzilla.suse.com/1228919

https://bugzilla.suse.com/1233821

https://lists.suse.com/pipermail/sle-security-updates/2024-December/020057.html

https://www.suse.com/security/cve/CVE-2024-11407/

https://www.suse.com/security/cve/CVE-2024-7246/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20244436-1/

CVSS Analysis

CVSS v3.1

5.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

5.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Upstream

CVE-2024-11407 CVE-2024-7246

Ecosystems(7)

SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15 SP5

Timeline

PublishedDec 30, 2024

ModifiedDec 30, 2024