CVE-2022-3171
Medium
Description
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Google Protobuf-java
PublishedOct 12, 2022
First seenOct 12, 2022
Weakness typeCWE-20Improper input validation
How to fix
Update
- google protobuf-java3.16.3, 3.19.6, 3.20.3, 3.21.7 or later
- google google-protobuf3.16.3, 3.19.6, 3.20.3, 3.21.7 or later
- google protobuf-javalite3.16.3, 3.19.6, 3.20.3, 3.21.7 or later
- google protobuf-kotlin3.16.3, 3.19.6, 3.20.3, 3.21.7 or later
- google protobuf-kotlin-lite3.16.3, 3.19.6, 3.20.3, 3.21.7 or later
- com.google.protobuf:protobuf-java3.21.7, 3.20.3, 3.19.6, 3.16.3 or later
- com.google.protobuf:protobuf-kotlin3.21.7, 3.20.3, 3.19.6, 3.16.3 or later
- google-protobuf3.21.7, 3.20.3, 3.19.6, 3.16.3 or later
- com.google.protobuf:protobuf-javalite3.21.7, 3.20.3, 3.19.6, 3.16.3 or later
- com.google.protobuf:protobuf-kotlin-lite3.21.7, 3.20.3, 3.19.6, 3.16.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google protobuf-java | v < 3.16.3, 3.17.0 ≤ v < 3.19.6, 3.20.0 ≤ v < 3.20.3, 3.21.0 ≤ v < 3.21.7 | 3.16.3, 3.19.6, 3.20.3, 3.21.7 |
| google google-protobuf | v < 3.16.3, 3.17.0 ≤ v < 3.19.6, 3.20.0 ≤ v < 3.20.3, 3.21.0 ≤ v < 3.21.7 | 3.16.3, 3.19.6, 3.20.3, 3.21.7 |
| google protobuf-javalite | v < 3.16.3, 3.17.0 ≤ v < 3.19.6, 3.20.0 ≤ v < 3.20.3, 3.21.0 ≤ v < 3.21.7 | 3.16.3, 3.19.6, 3.20.3, 3.21.7 |
| google protobuf-kotlin | v < 3.16.3, 3.17.0 ≤ v < 3.19.6, 3.20.0 ≤ v < 3.20.3, 3.21.0 ≤ v < 3.21.7 | 3.16.3, 3.19.6, 3.20.3, 3.21.7 |
| google protobuf-kotlin-lite | v < 3.16.3, 3.17.0 ≤ v < 3.19.6, 3.20.0 ≤ v < 3.20.3, 3.21.0 ≤ v < 3.21.7 | 3.16.3, 3.19.6, 3.20.3, 3.21.7 |
| fedoraproject fedora | 37 | — |
| com.google.protobuf:protobuf-javaMaven | 3.21.0-rc-1 ≤ v < 3.21.7, 3.20.0-rc-1 ≤ v < 3.20.3, 3.17.0-rc-1 ≤ v < 3.19.6, v < 3.16.3 | 3.21.7, 3.20.3, 3.19.6, 3.16.3 |
| com.google.protobuf:protobuf-kotlinMaven | 3.21.0-rc-1 ≤ v < 3.21.7, 3.20.0-rc-1 ≤ v < 3.20.3, 3.17.0-rc-1 ≤ v < 3.19.6, v < 3.16.3 | 3.21.7, 3.20.3, 3.19.6, 3.16.3 |
| google-protobufRubyGems | 3.21.0.rc.1 ≤ v < 3.21.7, 3.20.0.rc.1 ≤ v < 3.20.3, 3.17.0.rc.1 ≤ v < 3.19.6, v < 3.16.3 | 3.21.7, 3.20.3, 3.19.6, 3.16.3 |
| com.google.protobuf:protobuf-javaliteMaven | 3.21.0-rc-1 ≤ v < 3.21.7, 3.20.0-rc-1 ≤ v < 3.20.3, 3.17.0-rc-1 ≤ v < 3.19.6, v < 3.16.3 | 3.21.7, 3.20.3, 3.19.6, 3.16.3 |
| com.google.protobuf:protobuf-kotlin-liteMaven | 3.21.0-rc-1 ≤ v < 3.21.7, 3.20.0-rc-1 ≤ v < 3.20.3, 3.17.0-rc-1 ≤ v < 3.19.6, v < 3.16.3 | 3.21.7, 3.20.3, 3.19.6, 3.16.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.