* [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 @ 2026-10-15 4:40 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-15 4:40 ` [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-22 19:13 ` [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Bruce Ashfield 0 siblings, 2 replies; 4+ messages in thread From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-15 4:40 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external From: Hetvi Thakar <hthakar@cisco.com> Analysis: - CVE-2023-33953 affects the gRPC C-core HPACK parser used by the C++, Python, and Ruby implementations [1][2]. - grpc-go is an independent Go implementation and does not contain the affected C-core HPACK path [1][2]. - The grpc-go v1.56.1 to v1.56.2 comparison contains no HPACK security fix, so the C-core 1.56.2 fixed-version boundary does not apply [3]. - Hence ignoring the CVE for grpc-go. Reference: [1] https://cloud.google.com/support/bulletins#gcp-2023-022 [2] https://github.com/advisories/GHSA-496j-2rq6-j6cc [3] https://github.com/grpc/grpc-go/compare/v1.56.1...v1.56.2 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> --- recipes-devtools/go/grpc-go_git.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb index 2b5894d3..7c8e05ca 100644 --- a/recipes-devtools/go/grpc-go_git.bb +++ b/recipes-devtools/go/grpc-go_git.bb @@ -46,3 +46,4 @@ CVE_PRODUCT += "grpc" # grpc-go (Go implementation in meta-virtualization) does not # contain the affected HPACK code path. CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go." +CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go." -- 2.35.6 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 2026-10-15 4:40 [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-15 4:40 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-22 19:13 ` Bruce Ashfield 2026-10-22 19:13 ` [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Bruce Ashfield 1 sibling, 1 reply; 4+ messages in thread From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-15 4:40 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external From: Hetvi Thakar <hthakar@cisco.com> Analysis: - CVE-2024-37168 affects the JavaScript implementation distributed as the @grpc/grpc-js npm package [1]. - The grpc-go recipe builds the independent Go implementation and does not contain the affected JavaScript message handling paths [1]. - Hence ignoring the CVE for grpc-go as an incorrect CPE match. Reference: [1] https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> --- recipes-devtools/go/grpc-go_git.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb index 7c8e05ca..6d56ed20 100644 --- a/recipes-devtools/go/grpc-go_git.bb +++ b/recipes-devtools/go/grpc-go_git.bb @@ -47,3 +47,4 @@ CVE_PRODUCT += "grpc" # contain the affected HPACK code path. CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go." CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go." +CVE_STATUS[CVE-2024-37168] = "cpe-incorrect: affects @grpc/grpc-js, not grpc-go" -- 2.35.6 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 2026-10-15 4:40 ` [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-22 19:13 ` Bruce Ashfield 0 siblings, 0 replies; 4+ messages in thread From: Bruce Ashfield @ 2026-10-22 19:13 UTC (permalink / raw) To: meta-virtualization; +Cc: hthakar merged Bruce ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 2026-10-15 4:40 [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-15 4:40 ` [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-22 19:13 ` Bruce Ashfield 1 sibling, 0 replies; 4+ messages in thread From: Bruce Ashfield @ 2026-10-22 19:13 UTC (permalink / raw) To: meta-virtualization; +Cc: hthakar merged Bruce ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-22 19:13 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-15 4:40 [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-15 4:40 ` [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-22 19:13 ` Bruce Ashfield 2026-10-22 19:13 ` [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953 Bruce Ashfield
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.