Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1653-1

Опубликовано: 29 апр. 2026
Источник: suse-cvrf

Описание

Security update for protobuf

This update for protobuf fixes the following issues:

Refresh fixes:

  • CVE-2025-4565: parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages can lead to crash due to RecursionError (bsc#1244663).
  • CVE-2026-0994: max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages and lead to the exhaustion of the Python recursion stack (bsc#1257173).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Micro 5.2
libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Micro 5.3
libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Micro 5.4
libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Micro 5.5
libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
libprotobuf20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Package Hub 15 SP7
python3-protobuf-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Public Cloud 15 SP4
python3-protobuf-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Public Cloud 15 SP5
python3-protobuf-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Public Cloud 15 SP6
python3-protobuf-3.9.2-150200.4.33.1
SUSE Linux Enterprise Module for Public Cloud 15 SP7
python3-protobuf-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server 15 SP4-LTSS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server 15 SP5-LTSS
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server 15 SP6-LTSS
libprotobuf20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
libprotobuf-lite20-3.9.2-150200.4.33.1
libprotobuf20-3.9.2-150200.4.33.1
libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
libprotobuf20-3.9.2-150200.4.33.1

Ссылки

Описание

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libprotobuf-lite20-3.9.2-150200.4.33.1
Ссылки

Описание

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python's recursion stack and causing a RecursionError.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf-lite20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotoc20-3.9.2-150200.4.33.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libprotobuf-lite20-3.9.2-150200.4.33.1
Ссылки