Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 918419 - <dev-db/etcd-3.4.28: http/2 rapid reset vulnerability
Summary: <dev-db/etcd-3.4.28: http/2 rapid reset vulnerability
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [stable?]
Depends on:
Blocks: CVE-2023-44487
  Show dependency tree
Reported: 2023-11-24 19:12 UTC by John Helmert III
Modified: 2023-11-25 07:03 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-11-24 19:12:06 UTC

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

It's not quite explicit but this appears to be fixed in 3.5.10
according to the changelog, by upgrading grpc-go:

Please bump to 3.5.10.
Comment 1 Larry the Git Cow gentoo-dev 2023-11-25 06:55:26 UTC
The bug has been referenced in the following commit(s):

commit b760fba58a93c17e3eee678f2c5d961c08671772
Author:     Zac Medico <>
AuthorDate: 2023-11-25 06:54:26 +0000
Commit:     Zac Medico <>
CommitDate: 2023-11-25 06:55:21 +0000

    dev-db/etcd: add 3.4.28
    Signed-off-by: Zac Medico <>

 dev-db/etcd/Manifest           |  2 ++
 dev-db/etcd/etcd-3.4.28.ebuild | 79 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)
Comment 2 Zac Medico gentoo-dev 2023-11-25 07:00:39 UTC
I'm having some difficulty with a network-sandbox violation for 3.5.10, but 3.4.28 has the grpc 1.58.3 upgrade which was backported in
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-11-25 07:03:23 UTC
Indeed, thanks! Please stabilize when ready.