GHSA-h4h5-3hr4-j3g2

Suggest an improvement
Source
https://github.com/advisories/GHSA-h4h5-3hr4-j3g2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-h4h5-3hr4-j3g2/GHSA-h4h5-3hr4-j3g2.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-h4h5-3hr4-j3g2
Aliases
Related
Published
2022-10-04T22:17:15Z
Modified
2024-10-15T05:57:21.359349Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
protobuf-java has a potential Denial of Service issue
Details

Summary

A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Reporter: OSS Fuzz

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2022-3171 Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3) google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)

Database specific
{
    "nvd_published_at": "2022-10-12T23:15:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-04T22:17:15Z"
}
References

Affected packages

Maven / com.google.protobuf:protobuf-java

Package

Name
com.google.protobuf:protobuf-java
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-java

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.21.0-rc-1
Fixed
3.21.7

Affected versions

3.*

3.21.0-rc-1
3.21.0-rc-2
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.21.6

Maven / com.google.protobuf:protobuf-kotlin

Package

Name
com.google.protobuf:protobuf-kotlin
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.21.0-rc-1
Fixed
3.21.7

Affected versions

3.*

3.21.0-rc-1
3.21.0-rc-2
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.21.6

RubyGems / google-protobuf

Package

Name
google-protobuf
Purl
pkg:gem/google-protobuf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.21.0.rc.1
Fixed
3.21.7

Affected versions

3.*

3.21.0.rc.1
3.21.0.rc.2
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.21.6

Maven / com.google.protobuf:protobuf-javalite

Package

Name
com.google.protobuf:protobuf-javalite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-javalite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.21.0-rc-1
Fixed
3.21.7

Affected versions

3.*

3.21.0-rc-1
3.21.0-rc-2
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.21.6

Maven / com.google.protobuf:protobuf-kotlin-lite

Package

Name
com.google.protobuf:protobuf-kotlin-lite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin-lite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.21.0-rc-1
Fixed
3.21.7

Affected versions

3.*

3.21.0-rc-1
3.21.0-rc-2
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.21.6

Maven / com.google.protobuf:protobuf-java

Package

Name
com.google.protobuf:protobuf-java
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-java

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.20.0-rc-1
Fixed
3.20.3

Affected versions

3.*

3.20.0-rc-1
3.20.0
3.20.1-rc-1
3.20.1
3.20.2

Maven / com.google.protobuf:protobuf-java

Package

Name
com.google.protobuf:protobuf-java
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-java

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.17.0-rc-1
Fixed
3.19.6

Affected versions

3.*

3.17.0-rc-1
3.17.0-rc-2
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0-rc-1
3.18.0-rc-2
3.18.0
3.18.1
3.18.2
3.18.3
3.19.0-rc-1
3.19.0-rc-2
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5

Maven / com.google.protobuf:protobuf-java

Package

Name
com.google.protobuf:protobuf-java
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-java

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.16.3

Affected versions

2.*

2.0.1
2.0.3
2.1.0
2.2.0
2.3.0
2.4.0a
2.4.1
2.5.0
2.6.0
2.6.1

3.*

3.0.0-alpha-2
3.0.0-alpha-3
3.0.0-alpha-3.1
3.0.0-beta-1
3.0.0-beta-2
3.0.0-beta-3
3.0.0-beta-4
3.0.0
3.0.2
3.1.0
3.2.0rc2
3.2.0-rc.1
3.2.0
3.3.0
3.3.1
3.4.0
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0-rc1
3.7.0
3.7.1
3.8.0-rc-1
3.8.0
3.9.0-rc-1
3.9.0
3.9.1
3.9.2
3.10.0-rc-1
3.10.0
3.11.0-rc-1
3.11.0-rc-2
3.11.0
3.11.1
3.11.3
3.11.4
3.12.0-rc-1
3.12.0-rc-2
3.12.0
3.12.1
3.12.2
3.12.4
3.13.0-rc-3
3.13.0
3.14.0-rc-1
3.14.0-rc-2
3.14.0-rc-3
3.14.0
3.15.0-rc-1
3.15.0-rc-2
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.15.5
3.15.6
3.15.7
3.15.8
3.16.0-rc-1
3.16.0-rc-2
3.16.0
3.16.1

Maven / com.google.protobuf:protobuf-kotlin

Package

Name
com.google.protobuf:protobuf-kotlin
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.20.0-rc-1
Fixed
3.20.3

Affected versions

3.*

3.20.0-rc-1
3.20.0
3.20.1-rc-1
3.20.1
3.20.2

Maven / com.google.protobuf:protobuf-kotlin

Package

Name
com.google.protobuf:protobuf-kotlin
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.17.0-rc-1
Fixed
3.19.6

Affected versions

3.*

3.17.0-rc-2
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0-rc-1
3.18.0-rc-2
3.18.0
3.18.1
3.18.2
3.18.3
3.19.0-rc-1
3.19.0-rc-2
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5

Maven / com.google.protobuf:protobuf-kotlin

Package

Name
com.google.protobuf:protobuf-kotlin
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.16.3

RubyGems / google-protobuf

Package

Name
google-protobuf
Purl
pkg:gem/google-protobuf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.20.0.rc.1
Fixed
3.20.3

Affected versions

3.*

3.20.0.rc.1
3.20.0.rc.2
3.20.0
3.20.1.rc.1
3.20.1
3.20.2

RubyGems / google-protobuf

Package

Name
google-protobuf
Purl
pkg:gem/google-protobuf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.17.0.rc.1
Fixed
3.19.6

Affected versions

3.*

3.17.0.rc.1
3.17.0.rc.2
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0.rc.1
3.18.0.rc.2
3.18.0
3.18.1
3.18.2
3.18.3
3.19.0.rc.1
3.19.0.rc.2
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5

RubyGems / google-protobuf

Package

Name
google-protobuf
Purl
pkg:gem/google-protobuf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.16.3

Affected versions

3.*

3.0.0.alpha.1.0
3.0.0.alpha.1.1
3.0.0.alpha.2.0
3.0.0.alpha.3
3.0.0.alpha.3.1.pre
3.0.0.alpha.4.0
3.0.0.alpha.5.0.3
3.0.0.alpha.5.0.4
3.0.0.alpha.5.0.5
3.0.0.alpha.5.0.5.1
3.0.0
3.0.2
3.1.0.0.pre
3.1.0
3.2.0
3.2.0.1
3.2.0.2
3.2.1.pre
3.3.0
3.4.0.1
3.4.0.2
3.4.1.1
3.5.0.pre
3.5.0
3.5.1
3.5.1.1
3.5.1.2
3.6.0
3.6.1
3.7.0.rc.2
3.7.0.rc.3
3.7.0
3.7.1
3.8.0.rc.1
3.8.0
3.9.0.rc.1
3.9.0
3.9.1
3.9.2
3.10.0.rc.1
3.10.1
3.11.0.rc.1
3.11.0.rc.2
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0.rc.1
3.12.0.rc.2
3.12.0
3.12.1
3.12.2
3.12.4
3.13.0.rc.3
3.13.0
3.14.0.rc.1
3.14.0.rc.2
3.14.0.rc.3
3.14.0
3.15.0.rc.1
3.15.0.rc.2
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.15.5
3.15.6
3.15.7
3.15.8
3.16.0.rc.1
3.16.0.rc.2
3.16.0

Maven / com.google.protobuf:protobuf-javalite

Package

Name
com.google.protobuf:protobuf-javalite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-javalite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.20.0-rc-1
Fixed
3.20.3

Affected versions

3.*

3.20.0-rc-1
3.20.0
3.20.1-rc-1
3.20.1
3.20.2

Maven / com.google.protobuf:protobuf-javalite

Package

Name
com.google.protobuf:protobuf-javalite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-javalite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.17.0-rc-1
Fixed
3.19.6

Affected versions

3.*

3.17.0-rc-1
3.17.0-rc-2
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0-rc-1
3.18.0-rc-2
3.18.0
3.18.1
3.18.2
3.18.3
3.19.0-rc-1
3.19.0-rc-2
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5

Maven / com.google.protobuf:protobuf-javalite

Package

Name
com.google.protobuf:protobuf-javalite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-javalite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.16.3

Affected versions

3.*

3.8.0-rc-1
3.8.0
3.9.0-rc-1
3.9.0
3.9.1
3.9.2
3.10.0-rc-1
3.10.0
3.11.0-rc-1
3.11.0-rc-2
3.11.0
3.11.1
3.11.3
3.11.4
3.12.0-rc-1
3.12.0-rc-2
3.12.0
3.12.1
3.12.2
3.12.4
3.13.0-rc-3
3.13.0
3.14.0-rc-1
3.14.0-rc-2
3.14.0-rc-3
3.14.0
3.15.0-rc-1
3.15.0-rc-2
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.15.5
3.15.6
3.15.7
3.15.8
3.16.0-rc-1
3.16.0-rc-2
3.16.0
3.16.1

Maven / com.google.protobuf:protobuf-kotlin-lite

Package

Name
com.google.protobuf:protobuf-kotlin-lite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin-lite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.20.0-rc-1
Fixed
3.20.3

Affected versions

3.*

3.20.0-rc-1
3.20.0
3.20.1-rc-1
3.20.1
3.20.2

Maven / com.google.protobuf:protobuf-kotlin-lite

Package

Name
com.google.protobuf:protobuf-kotlin-lite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin-lite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.17.0-rc-1
Fixed
3.19.6

Affected versions

3.*

3.17.0-rc-2
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0-rc-1
3.18.0-rc-2
3.18.0
3.18.1
3.18.2
3.18.3
3.19.0-rc-1
3.19.0-rc-2
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5

Maven / com.google.protobuf:protobuf-kotlin-lite

Package

Name
com.google.protobuf:protobuf-kotlin-lite
View open source insights on deps.dev
Purl
pkg:maven/com.google.protobuf/protobuf-kotlin-lite

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.16.3