Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2022-1941

Published: 22 September 2022

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Priority

Low

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package Release Status
protobuf
Launchpad, Ubuntu, Debian
bionic
Released (3.0.0-9.1ubuntu1.1)
focal
Released (3.6.1.3-2ubuntu5.2)
jammy
Released (3.12.4-1ubuntu7.22.04.1)
kinetic
Released (3.12.4-1ubuntu7.22.10.1)
lunar Not vulnerable
(3.21.12-1ubuntu6)
trusty Ignored
(changes too intrusive)
upstream Needs triage

xenial
Released (2.6.1-1.3ubuntu0.1~esm2)
Patches:
upstream: https://github.com/protocolbuffers/protobuf/commit/b4c395aaedfacb32e2414d361fa85968c0991b34

Severity score breakdown

Parameter Value
Base score 7.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H