GHSA-m425-mq94-257g
CVE Details
Last Update
8/16/24
NIST CVE Summary
The affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.
Our Official Summary
CVE exists in coredns that’s being used in k8s 1.28.11. Affects only k8s version 1.28.11. For customer workload clusters, workaround is to use k8s version 1.29+. For Palette Self Hosted cluster, a future release will upgrade to 1.29+.
CVE Severity
Status
Ongoing
Affected Products & Versions
- Palette VerteX 4.4.11
- Palette VerteX 4.4.14
Revision History
- 1.0 07/16/2024 Initial Publication
- 2.0 08/16/2024 Added palette VerteX 4.4.14 to Affected Products