[GHSA-prj3-ccx8-p6x4] Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

[jjweston]

Updates

• Affected products
• CVSS v3

Comments
The latest version of io.grpc:grpc-netty-shaded is 1.75.0. I see nothing that suggests there is a version 1.175.0 and I assume that this was a typo. The change log for version 1.75.0 claims it contains a fix for the MadeYouReset vulnerability:

https://github.com/grpc/grpc-java/releases/tag/v1.75.0

The relevant portion from the change log:

• netty: Count sent RST_STREAMs against NettyServerBuilder.maxRstFramesPerWindow() limit (#12288). This extends the Rapid Reset tool to also cover MadeYouReset. the reset stream count will cause a 420 "Enhance your calm response" to be sent. This depends on Netty 4.1.124 for a bug fix to actually call the encoder by the frame writer.

[github]

Hi there @normanmaurer! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[jjweston]

I'm not sure why there are deletions to the CVSS_V3 section. I didn't intend to change anything there. The only change I intended to submit is the version for the fixed version of io.grpc:grpc-netty-shaded.

[ejona86]

1.75.0 is appropriate (1.175.0 is completely wrong, and it isn't clear to me how it was added.)

[advisory-database]

Hi @jjweston! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!