grpc-ecosystem / grpc-ecosystem/java-grpc-prometheus

Fix Vulnerability in grpc-okhttp Dependency (CVE-2023-3635)

Open
#59 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
236
Forks
80
PR merge metrics
No merged PRs in 30d

Description

The java-grpc-prometheus library utilizes `grpc-okhttp`, which in turn relies on the `okio` library. The `okio` library, specifically version `2.10.0`, contains a critical security vulnerability identified as CVE-2023-3635. This vulnerability has been assigned a CVSS score of 7.5 and falls under the CWE categories 195 (Signed to Unsigned Conversion Error) and 681 (Incorrect Conversion between Numeric Types).

The vulnerability arises from the mishandling of exceptions in the GzipSource class within the okio library. When parsing a malformed gzip buffer, an exception may not be properly handled, potentially leading to a denial of service for applications utilizing grpc-okhttp, including the java-grpc-prometheus library.

Addressing this vulnerability is essential to maintain the integrity and security of systems relying on the java-grpc-prometheus library. Your attention to this matter is greatly appreciated.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.