CVE-2023-32731

一、漏洞信息
 漏洞编号：[CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731)
 漏洞归属组件：[gRPC](https://gitee.com/qinsheng99/cve-manager_test)
 漏洞归属的版本：1.36.1
 CVSS V3.0分值：
  BaseScore：7.4 High
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
 漏洞简述：
  When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in  https://github.com/grpc/grpc/pull/32309 https://github.com/grpc/grpc/pull/32309 
 漏洞公开时间：2023-06-09 21:03:00
 漏洞创建时间：2023-06-15 09:50:03
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-32731
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/mindspore/community/blob/master/security/cve_issue_template.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  
 MindSpore评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master:
2.v1.7.0:
3.v1.8.0:
4.v2.0.0:

code/cve-manager_test

内容风险标识

评论 (1)

code/cve-manager_test .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-32731

评论 (1)

搜索帮助

code/cve-manager_test