CVE-2024-8391

Опубликовано: 04 сент. 2024

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).

This is fixed in the 4.5.10 version.

Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

Ссылки

https://github.com/eclipse-vertx/vertx-grpc/issues/113
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignement/-/issues/31
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.5.10 (исключая)

EPSS

Процентиль: 58%

0.00364

Низкий

7.5 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

CVE-2024-8391

CVSS3: 7.5

redhat

больше 1 года назад

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client). This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

GHSA-g76f-gjfx-4rpr

CVSS3: 5.8

github