Fluid Attacks Database

Description

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	protobuf	>=0 <3.21.9-3	3.21.9-3
debian 14	protobuf	>=0 <3.21.9-3	3.21.9-3
maven	com.google.protobuf:protobuf-java	>=0 <3.16.1 \|\| >=3.18.0 <3.18.2 \|\| >=3.19.0 <3.19.2	3.16.1, 3.18.2, 3.19.2
debian 13	protobuf	>=0 <3.21.9-3	3.21.9-3
rubygems	google-protobuf	>=0 <3.19.2	3.19.2
maven	com.google.protobuf:protobuf-kotlin	>=3.18.0 <3.18.2 \|\| >=3.19.0 <3.19.2	3.18.2, 3.19.2

Aliases

1. CVE-2021-225692. NVD-2021-225693. OSV-DEBIAN-2021-225694. OSV-2021-225695. GHSA-wrvw-hg22-4m676. GCVE-2021-225697. SECURITY-TRACKER-CVE-2021-22569

References

1. https://github.com/Mario-Kart-Felix/A-potential-Denial-of-Service-issue-in-protobuf-java2. https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m673. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=393304. https://cloud.google.com/support/bulletins#gcp-2022-0015. https://www.oracle.com/security-alerts/cpuapr2022.html6. http://www.openwall.com/lists/oss-security/2022/01/12/47. http://www.openwall.com/lists/oss-security/2022/01/12/7

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.