Описание
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| protobuf | fixed | 3.21.12-16 | package | |
| protobuf | fixed | 3.21.12-11+deb13u1 | trixie | package |
| protobuf | fixed | 3.21.12-3+deb12u1 | bookworm | package |
| protobuf | postponed | bullseye | package |
Примечания
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc
https://github.com/protocolbuffers/protobuf/issues/24159
Fixed by: https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a (v4.33.6)
https://github.com/protocolbuffers/protobuf/issues/25067
Fixed by: https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038 (v4.33.6)
EPSS
Связанные уязвимости
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Уязвимость библиотеки сериализации данных protobuf, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании
EPSS