search

icerpc / icerpc-csharp

A C# RPC framework built for QUIC, with bidirectional streaming, first-class async/await, and Protobuf support.
https://docs.icerpc.dev
Apache License 2.0
101 stars 13 forks source link

Review Slic potential security issues #3317

Open bentoi opened 1 year ago

bentoi commented 1 year ago

See https://github.com/dotnet/runtime/issues/30600

I believe of these apply to Slic and in particular the PING flood attack (https://github.com/advisories/GHSA-hgr8-6h9x-f7q9) if we keep the PONG frame. See also https://github.com/icerpc/icerpc-csharp/issues/3273

I'm targeting this for 0.2, please change if you prefer to look into this for 0.1.

bentoi commented 1 year ago

See also https://www.bleepingcomputer.com/news/security/new-http-2-flaws-expose-unpatched-web-servers-to-dos-attacks/