CVE-2023-1428: gRPC Reachable Assertion Issue in grpcio Package
Summary
CVE-2023-1428: gRPC Reachable Assertion issue. Affects grpcio versions >= 1.51.0, < 1.53.0. Fixed in 1.53.0. How to fix ↓
Also tracked for
- Grpc.Core · NuGet
- io.grpc:grpc-protobuf · Maven
The same CVE-2023-1428 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gRPC is a high-performance, open-source universal RPC framework that enables communication between applications in a distributed system. It supports multiple programming languages and is widely used for building microservices. The grpcio package is the Python implementation of gRPC, allowing developers to create efficient APIs. However, it is susceptible to a specific vulnerability that can lead to application crashes under certain conditions.
Vulnerability Detail
The vulnerability in question is a reachable assertion issue in gRPC's C++ implementation, which can cause the application to abort unexpectedly. This occurs when specific HTTP/2 headers are sent, including 'te: x', ':scheme: x', and 'grpclb_client_stats: x', combined with a total header size exceeding 8KB. If exploited, this vulnerability can lead to service disruptions and potential denial of service.
How To Fix
Minimum fixed version
1.53.0
This is the first release that contains the fix.
pip install --upgrade "grpcio==1.53.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sending the specified headers ('te: x', ':scheme: x', 'grpclb_client_stats: x') in your HTTP/2 requests until you can upgrade to the patched version.
Conclusion
The gRPC Reachable Assertion issue (CVE-2023-1428) poses a significant risk to applications using the grpcio package. It is crucial to upgrade to the latest version to mitigate this vulnerability and ensure the stability of your services.
See every vulnerability recorded for grpcio →
FAQ
CVE-2023-1428 is a vulnerability in the grpcio package that can cause an application to abort due to specific HTTP/2 headers being sent.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to application crashes and service disruptions, potentially resulting in a denial of service.
You can upgrade the grpcio package by running the command 'pip install --upgrade grpcio' in your terminal.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpcio.
