CVE-2021-22569
High
Description
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Google Protobuf-java
PublishedJan 10, 2022
First seenJan 10, 2022
Weakness typeCWE-696CWE-696
How to fix
Update
- google protobuf-java3.16.1, 3.18.2, 3.19.2 or later
- google google-protobuf3.19.2 or later
- google protobuf-kotlin3.18.2, 3.19.2 or later
- com.google.protobuf:protobuf-java3.16.1, 3.18.2, 3.19.2 or later
- google-protobuf3.19.2 or later
- com.google.protobuf:protobuf-kotlin3.18.2, 3.19.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google protobuf-java | v < 3.16.1, 3.18.0 ≤ v < 3.18.2, 3.19.0 ≤ v < 3.19.2 | 3.16.1, 3.18.2, 3.19.2 |
| google google-protobuf | v < 3.19.2 | 3.19.2 |
| google protobuf-kotlin | v < 3.18.2, 3.19.0 ≤ v < 3.19.2 | 3.18.2, 3.19.2 |
| oracle communications_cloud_native_core_console | 1.9.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.15.0, 1.15.1 | — |
| oracle communications_cloud_native_core_policy | 1.15.0 | — |
| oracle spatial_and_graph_mapviewer | 19c, 21c | — |
| com.google.protobuf:protobuf-javaMaven | v < 3.16.1, 3.18.0 ≤ v < 3.18.2, 3.19.0 ≤ v < 3.19.2 | 3.16.1, 3.18.2, 3.19.2 |
| google-protobufRubyGems | v < 3.19.2 | 3.19.2 |
| com.google.protobuf:protobuf-kotlinMaven | 3.18.0 ≤ v < 3.18.2, 3.19.0 ≤ v < 3.19.2 | 3.18.2, 3.19.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.