Stack overflow in Protocol Buffers Java Lite
Summary
Stack overflow in Protocol Buffers Java Lite
Original description
The description as published by the source.
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2024-7254 protobuf
- Debian DEBIAN-CVE-2024-7254 protobuf
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory security.netapp.com
- package github.com
- patch github.com
- web mvnrepository.com
- web rubygems.org