x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32731

[GoVulnBot]

CVE-2023-32731 references github.com/grpc/grpc, which may be a Go module.

Description:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in  grpc/grpc#32309 grpc/grpc#32309

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
• JSON: https://github.com/CVEProject/cvelist/tree/d7e32be7573de4aa3808f24e3c0c7ccd60e74d6c/2023/32xxx/CVE-2023-32731.json
• fix: [http2] Dont drop connections on metadata limit exceeded grpc/grpc#32309
• Imported by: https://pkg.go.dev/github.com/grpc/grpc?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/grpc/grpc
      packages:
        - package: gRPC
description: "When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in  https://github.com/grpc/grpc/pull/32309 https://github.com/grpc/grpc/pull/32309 \n\n"
cves:
    - CVE-2023-32731
references:
    - fix: https://github.com/grpc/grpc/pull/32309

[neild]

C++, not Go.

[gopherbot]

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports