Stack overflow in Protocol Buffers Java Lite
Résumé
Stack overflow in Protocol Buffers Java Lite
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2024-7254 protobuf
- Debian DEBIAN-CVE-2024-7254 protobuf
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory security.netapp.com
- package github.com
- patch github.com
- web mvnrepository.com
- web rubygems.org