Memory handling vulnerability in ProtocolBuffers Java core and lite
Résumé
Memory handling vulnerability in ProtocolBuffers Java core and lite
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2022-3171
- Debian DEBIAN-CVE-2022-3171 protobuf
- Ubuntu UBUNTU-CVE-2022-3171 protobuf
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- package github.com
- web bugs.chromium.org
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org