[AV-142872] Fix critical issue in google.golang.org/grpc via minor version upgrade from 1.56.3 to 1.79.3 - #21
Closed
aikido-autofix[bot] wants to merge 1 commit into
Conversation
aikido-autofix
Bot
added
aikido
allabalakrishna9
added a commit
that referenced
this pull request
Sep 6, 2026
Folds in the third Aikido AutoFix PR (#21, AV-142872), which proposed grpc 1.56.3 -> 1.79.3 but was generated against main and so would have downgraded what this branch already fixes: x/net v0.58.0 -> v0.48.0 (0 advisories -> 9) x/crypto v0.55.0 -> v0.46.0 (3 advisories -> 30) go 1.25.0 -> 1.24.0 That is 36 advisories re-introduced to gain 4. Taking grpc v1.83.2 rather than the v1.79.3 that PR proposed. v1.79.3 still carries 3 advisories, including GHSA-vp52-pcj8-j9qc (heap exhaustion via HTTP/2 DATA frame fragmentation) and the xDS RBAC issues. v1.83.2 has none, and it requires exactly what this branch already sets: go 1.25.0, x/net v0.58.0, x/sys v0.47.0, x/text v0.41.0. No downgrade and no extra toolchain change. google.golang.org/grpc v1.56.3 -> v1.83.2 (5 advisories -> 0) google.golang.org/protobuf v1.30.0 -> v1.36.12 (2 advisories -> 0) github.com/golang/protobuf v1.5.3 -> v1.5.4 github.com/google/uuid v1.3.0 -> v1.6.0 Verified with go build ./... (clean). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #20, which now carries the grpc and protobuf bumps as well. This PR was generated against
That is 36 advisories re-introduced to gain 4. The grpc work itself was worth keeping and has been folded into #20, at a higher version than proposed here:
Also worth noting: this PR moved the Closing. AV-142872 stays open and is linked from #20. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira
Pull Request Category
Testing Approach
How was this change tested and do you have evidence?
cbclocalUpgrade gRPC-Go to fix critical authorization bypass vulnerability caused by improper HTTP/2
:pathvalidation allowing attackers to bypass path-based security policies.✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE
This PR will resolve the following CVEs:
:pathvalidation allows requests without leading slashes to bypass path-based authorization interceptors, enabling attackers to circumvent "deny" rules and access restricted gRPC methods. This authorization bypass affects servers using path-based RBAC policies with fallback "allow" rules.🔗 Related Tasks