Veracode Vulnerability DatabaseVERACODE:33570Denial Of Service (DoS)
EPSS
Percentile
42.3%
protobuf is vulnerable to denial of service. The library does not properly handle unknown fields in the UnknownFieldSet function in UnknownFieldSet.java, allowing an attacker to crash the application through many short-lived objects by providing malicious payload.
References
www.openwall.com/lists/oss-security/2022/01/12/4
www.openwall.com/lists/oss-security/2022/01/12/7
bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
cloud.google.com/support/bulletins#gcp-2022-001
github.com/advisories/GHSA-wrvw-hg22-4m67
github.com/protocolbuffers/protobuf/commit/36a2fe60090a277e0e740c8498ae715e87f6b9b7
github.com/protocolbuffers/protobuf/commit/9638a5e5315bf73f5e7148c16181676372321892
github.com/protocolbuffers/protobuf/commit/f554ccaa514967232cc494cf22947e1c73ca747f
www.oracle.com/security-alerts/cpuapr2022.html
Related
