CVE-2023-32731

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005

These are all security issues fixed in the grpc-devel-1.60.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-grpcio-1.60.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-grpcio-1.84.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for abseil-cpp, grpc, opencensus-proto, protobuf, python-abseil, python-grpcio, re2 fixes the following issues:

abseil-cpp was updated to:

Update to 20230802.1:

• Add StdcppWaiter to the end of the list of waiter implementations

Update to 20230802.0

What's New:

• Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes.
• Added the prefetch library as a portable layer for moving data into caches before it is read.
• Abseil's hash tables now detect many more programming errors in debug and sanitizer builds.
• Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted.
• Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags.
• absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target.

Update to 20230125.3

Details can be found on:

https://github.com/abseil/abseil-cpp/releases/tag/20230125.3

Update to 20230125.2

What's New:

The Abseil logging library has been released. This library
provides facilities for writing short text messages about the
status of a program to stderr, disk files, or other sinks
(via an extension API). See the logging library documentation
for more information.
  An extension point, AbslStringify(), allows user-defined types
to seamlessly work with Abseil's string formatting functions
like absl::StrCat() and absl::StrFormat().
  A library for computing CRC32C checksums has been added.
  Floating-point parsing now uses the Eisel-Lemire algorithm,
which provides a significant speed improvement.
  The flags library now provides suggestions for the closest
flag(s) in the case of misspelled flags.
  Using CMake to install Abseil now makes the installed artifacts
(in particular absl/base/options.h) reflect the compiled ABI.

Breaking Changes:

Abseil now requires at least C++14 and follows Google's Foundational
C++ Support Policy. See this table for a list of currently supported
versions compilers, platforms, and build tools.
  The legacy spellings of the thread annotation macros/functions
(e.g. GUARDED_BY()) have been removed by default in favor of the
ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
can be defined on the compile command-line to temporarily restore these
spellings, but this compatibility macro will be removed in the future.

Known Issues

The Abseil logging library in this release is not a feature-complete
replacement for glog yet. VLOG and DFATAL are examples of features
that have not yet been released.

Update to version 20220623.0

What's New:

• Added absl::AnyInvocable, a move-only function type.
• Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code.
• Added support for command-line flags of type absl::optional<T>.

Breaking Changes:

• CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built.
• The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not…