CVE-2021-22570
Medium
Description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Google Protobuf
PublishedJan 26, 2022
First seenJan 26, 2022
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- google protobuf3.15.0 or later
- Google.Protobuf3.15.0 or later
- google/protobuf3.15.0 or later
- com.google.protobuf:protobuf-java3.15.0 or later
- github.com/protocolbuffers/protobuf0.0.0-20210218195015-ae50d9b99025, 3.15.0 or later
- protobuf3.15.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFX6KPNOFHYD6L4XES5PCM3QNSKZBOTQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DVUZPALAQ34TQP6KFNLM4IZS6B32XSA/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTWVQRB5OCCTMKEQFY5MYED3DXDVSLP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BTRGBRC5KGCA4SK5MUNLPYJRAGXMBIYY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google protobuf | v < 3.15.0 | 3.15.0 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| fedoraproject fedora | 34, 35, 36 | — |
| oracle mysql | v ≤ 8.0.28 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snapcenter | No range specified | — |
| Google.ProtobufNuGet | v < 3.15.0 | 3.15.0 |
| google/protobufPackagist | v < 3.15.0 | 3.15.0 |
| com.google.protobuf:protobuf-javaMaven | v < 3.15.0 | 3.15.0 |
| github.com/protocolbuffers/protobufGo | v < 0.0.0-20210218195015-ae50d9b99025, 0.0.0 ≤ v < 3.15.0 | 0.0.0-20210218195015-ae50d9b99025, 3.15.0 |
| protobufPyPI | v < 3.15.0 | 3.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.