ALT-PU-2023-1230: package protobuf update to version 3.21.12-alt1
Описание
This update upgrades protobuf to version 3.21.12-alt1.
Устраненные уязвимости6
Ссылки4
GHSA-8gq9-2x98-w8hf
https://github.com/advisories/GHSA-8gq9-2x98-w8hfGHSA-h4h5-3hr4-j3g2
https://github.com/advisories/GHSA-h4h5-3hr4-j3g2GHSA-wrvw-hg22-4m67
https://github.com/advisories/GHSA-wrvw-hg22-4m67Связанные уязвимости
Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets
Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets
ALT-PU-2026-11470: package `protobuf` update to version 3.21.12-alt4.p10.1
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.