CVE-2022-3171 Memory handling vulnerability in ProtocolBuffers Java core and lite

2022-10-1200:00:00

CWE-20

Google

www.cve.org

protocolbuffers java memory vulnerability denial of service attack cve-2022-3171 update advisory

4.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CNA Affected

[
  {
    "vendor": "Google LLC",
    "product": "Protocolbuffers",
    "versions": [
      {
        "version": "3.21.7",
        "status": "affected",
        "lessThan": "3.21.7",
        "versionType": "custom"
      },
      {
        "version": "3.20.3",
        "status": "affected",
        "lessThan": "3.20.3",
        "versionType": "custom"
      },
      {
        "version": "3.19.6",
        "status": "affected",
        "lessThan": "3.19.6",
        "versionType": "custom"
      },
      {
        "version": "3.16.3",
        "status": "affected",
        "lessThan": "3.16.3",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "core and lite"
    ]
  }
]