[GHSA-2v4p-qf9q-27wj] gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers - #9722
Conversation
|
Hi there @easwars! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
Duplicate of #9608 |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Removing the entire range incorrectly excludes vulnerable v1.84.0-dev builds.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates the advisory after gRPC-Go 1.84.0 shipped with the fix.
Changes:
- Removes the 1.84 development-version affected range.
- Advances the advisory modification timestamp.
| File | Description |
|---|---|
GHSA-2v4p-qf9q-27wj.json |
Updates affected versions and metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Duplicate of #9608
Updates
Comments
1.84.0 release fixed that, isn't it?