Описание
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 3.21.12-1ubuntu6 |
| esm-infra-legacy/trusty | ignored | changes too intrusive |
| esm-infra/bionic | ignored | changes too intrusive |
| esm-infra/focal | ignored | changes too intrusive |
| esm-infra/xenial | ignored | changes too intrusive |
| focal | ignored | end of standard support, was ignored [changes too intrusive] |
| jammy | ignored | changes too intrusive |
| kinetic | ignored | end of life, was ignored [changes too intrusive] |
| lunar | not-affected | 3.21.12-1ubuntu6 |
Показывать по
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
A parsing issue with binary data in protobuf-java core and lite versio ...
EPSS
4.3 Medium
CVSS3