CVE-2022-1941
Description
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
How to fix
- google protobuf-cpp3.18.3, 3.19.5, 3.20.2, 3.21.6 or later
- google protobuf-python3.18.3, 3.19.5, 3.20.2, 4.21.6 or later
- protobuf3.18.3, 3.19.5, 3.20.2, 4.21.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google protobuf-cpp | v < 3.18.3, 3.19.0 ≤ v < 3.19.5, 3.20.0 ≤ v < 3.20.2, 3.21.0 ≤ v < 3.21.6 | 3.18.3, 3.19.5, 3.20.2, 3.21.6 |
| google protobuf-python | v < 3.18.3, 3.19.0 ≤ v < 3.19.5, 3.20.0 ≤ v < 3.20.2, 4.0.0 ≤ v < 4.21.6 | 3.18.3, 3.19.5, 3.20.2, 4.21.6 |
| fedoraproject fedora | 36, 37 | — |
| debian debian_linux | 10.0 | — |
| protobufPyPI | v < 3.18.3, 3.19.0 ≤ v < 3.19.5, 3.20.0 ≤ v < 3.20.2, 4.0.0 ≤ v < 4.21.6 | 3.18.3, 3.19.5, 3.20.2, 4.21.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.