CVE-2021-22569

Опубликовано: 10 янв. 2022

Источник: nvd

CVSS3: 7.5

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Ссылки

http://www.openwall.com/lists/oss-security/2022/01/12/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/7
Mailing List
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
Exploit
Issue Tracking
Mailing List
Vendor Advisory
https://cloud.google.com/support/bulletins#gcp-2022-001
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/7
Mailing List
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
Exploit
Issue Tracking
Mailing List
Vendor Advisory
https://cloud.google.com/support/bulletins#gcp-2022-001
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:google-protobuf:*:*:*:*:*:ruby:*:*

Версия до 3.19.2 (исключая)

cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*

Версия до 3.16.1 (исключая)

cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*

Версия от 3.18.0 (включая) до 3.18.2 (исключая)

cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*

Версия от 3.19.0 (включая) до 3.19.2 (исключая)

cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*

Версия до 3.18.2 (исключая)

cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*

Версия от 3.19.0 (включая) до 3.19.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:spatial_and_graph_mapviewer:19c:*:*:*:*:*:*:*

cpe:2.3:a:oracle:spatial_and_graph_mapviewer:21c:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.01655

Низкий

7.5 High

CVSS3

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-696

NVD-CWE-noinfo

Связанные уязвимости

CVE-2021-22569

CVSS3: 7.5

ubuntu

больше 4 лет назад

CVE-2021-22569

CVSS3: 5.5

redhat

больше 4 лет назад

CVE-2021-22569

CVSS3: 5.5

msrc

почти 2 года назад

Описание отсутствует

CVE-2021-22569

CVSS3: 7.5

debian

больше 4 лет назад

An issue in protobuf-java allowed the interleaving of com.google.proto ...

GHSA-wrvw-hg22-4m67

CVSS3: 7.5

github

больше 4 лет назад

A potential Denial of Service issue in protobuf-java

EPSS

Процентиль: 74%

0.01655

Низкий

7.5 High

CVSS3

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-696

NVD-CWE-noinfo