Description
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Google LLC protobuf-java
unspecified to < 3.16.1affectedunspecified to < 3.18.2affectedunspecified to < 3.19.2affected
Google LLC protobuf-kotlin
unspecified to < 3.18.2affectedunspecified to < 3.19.2affected
Google LLC google-protobuf [JRuby Gem]
unspecified to < 3.19.2affected
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330 ↗
- https://cloud.google.com/support/bulletins#gcp-2022-001 ↗
- http://www.openwall.com/lists/oss-security/2022/01/12/4 ↗
- http://www.openwall.com/lists/oss-security/2022/01/12/7 ↗
- https://www.oracle.com/security-alerts/cpuapr2022.html ↗
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html ↗