An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
Weakness
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Google-protobuf | * | 3.19.2 (excluding) | |
| Protobuf-java | * | 3.16.1 (excluding) | |
| Protobuf-java | 3.18.0 (including) | 3.18.2 (excluding) | |
| Protobuf-java | 3.19.0 (including) | 3.19.2 (excluding) | |
| Protobuf-kotlin | * | 3.18.2 (excluding) | |
| Protobuf-kotlin | 3.19.0 (including) | 3.19.2 (excluding) | |
| Red Hat build of Quarkus 2.7.5 | RedHat | protobuf-java | * |
| Red Hat Fuse 7.11 | RedHat | protobuf-java | * |
| RHINT Camel-Q 2.2.1 | RedHat | * | |
| RHINT Debezium 1.9.7 | RedHat | protobuf-java | * |
| RHINT Service Registry 2.3.0 GA | RedHat | protobuf-java | * |
| RHPAM 7.13.0 async | RedHat | protobuf-java | * |
| Text-Only RHOAR | RedHat | protobuf-java | * |
| Protobuf | Ubuntu | bionic | * |
| Protobuf | Ubuntu | esm-infra-legacy/trusty | * |
| Protobuf | Ubuntu | esm-infra/bionic | * |
| Protobuf | Ubuntu | esm-infra/focal | * |
| Protobuf | Ubuntu | esm-infra/xenial | * |
| Protobuf | Ubuntu | focal | * |
| Protobuf | Ubuntu | impish | * |
| Protobuf | Ubuntu | jammy | * |
| Protobuf | Ubuntu | kinetic | * |
| Protobuf | Ubuntu | trusty | * |
| Protobuf | Ubuntu | trusty/esm | * |
| Protobuf | Ubuntu | upstream | * |
| Protobuf | Ubuntu | xenial | * |
Related Attack Patterns
References
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://www.openwall.com/lists/oss-security/2022/01/12/4
- http://www.openwall.com/lists/oss-security/2022/01/12/7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://www.oracle.com/security-alerts/cpuapr2022.html